Install
One command. It just works.
Install the LinkMesh Server on any Linux VM in a single command. The.deb / .rpm postinstall generates the JWT secret, initializes the GitOps config repo, and seeds the default admin account, then starts the systemd service. It serves plain HTTP on port 8080 — put a reverse proxy in front to terminate TLS. Open the web UI and enroll your first Collector.
Full step-by-step guide including UI walkthrough and Kubernetes install:Quickstart on docs.linkmesh.io →
How it fits together
Server is the control plane. Your collectors enroll over one connection.
You install one thing: the Server (the .deb / .rpmbelow). Each OpenTelemetry Collector then enrolls with it over a single HTTPS connection on port 443 — otelcol-contrib via OpAMP, Grafana Alloy viaremotecfg — authenticating with a bearer token. The collector pulls its config from LinkMesh and manages itself; your telemetry never flows through LinkMesh — it goes straight from the collector to your own backends. Optionally, the LinkMesh agent runs alongside as an edge connector for guided onboarding and service/log discovery — it carries no telemetry and doesn't run your collector. See Trust for the data-handling specifics, and Architecture on docsfor the component topology in depth.
Quickstart — Linux
Install the Server
Pick the line that matches your distro and paste it on a fresh Linux VM. That's the whole install — the postinstall generates the JWT secret, initializes the GitOps config repo, and seeds the admin account, then starts the systemd service.
Ubuntu / Debian
curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server_latest_amd64.deb -o linkmesh-server.deb && sudo apt install -y ./linkmesh-server.debRHEL / Rocky / AlmaLinux
curl -fsSL https://artifacts.saas.opensight.ch/binaries/linkmesh-server/latest/linkmesh-server-latest.x86_64.rpm -o linkmesh-server.rpm && sudo dnf install -y ./linkmesh-server.rpmAfter install — set the admin password, then sign in
The install creates an admin account with a random password that is deliberately never written to any log. Set your own with the recovery command — it talks to the local server, so no prior login is needed:
sudo linkmesh-server reset-password --email admin --password 'choose-a-strong-password'Then open http://YOUR_HOST:8080 and sign in as admin. Omit--password to have a strong one generated and printed instead.
Running on Kubernetes, or want auto-updates from APT/YUM?
The Kubernetes install guideon docs covers Helm + manifests with reverse-proxy preset. For auto-updates via your system package manager, see repository setup.
Windows hosts work the same way
The Server itself is Linux-only, but collectors enroll from any OS. Windows hosts run otelcol-contrib (OpAMP) or Grafana Alloy (remotecfg) and connect over the same port-443 bearer-token handshake; the optional LinkMesh agent ships a Windows AMD64 binary too. After your Linux server is up, followAdd a Collector on docsfor the platform-specific enrollment commands.
Enroll your collectors
Connect with vanilla OpenTelemetry — no proprietary agent required.
LinkMesh manages whatever collector you already run. Point otelcol-contribat LinkMesh with the upstream opampsupervisor (OpAMP), or add aremotecfg block to Grafana Alloy. Both are open, standards-defined protocols; both authenticate with a bearer token over port 443 and leave the data plane (OTLP) untouched. Issue a one-time enrollment token in the UI, install on the host, and the collector appears in the fleet view within seconds.
otelcol-contrib · OpAMP
otelcol-contrib + opampsupervisor
The one-liner fetches both upstream binaries (collector + supervisor), writes the supervisor config, and starts the systemd unit. Swap in your own server's address if you're self-hosting.
curl -fsSL https://linkmesh.example.com/install-opamp.sh | \
sudo sh -s -- --token YOUR_TOKENThe supervisor opens a WebSocket to /v1/opamp, receives the config LinkMesh pushes, and writes it to the collector subprocess — you don't author the collector's config.yaml by hand. Full walkthrough:Onboard otelcol-contrib via OpAMP →
Grafana Alloy · remotecfg
Grafana Alloy
Alloy speaks its native remotecfg protocol — HTTP polling rather than OpAMP push. Add one block to your existing Alloy config, point it at the LinkMesh base URL, and authenticate with a per-collector bearer token minted from the collector detail page.
remotecfg {
url = "https://linkmesh.example.com"
id = constants.hostname
poll_frequency = "60s"
bearer_token = env("LINKMESH_TOKEN")
}Alloy reloads its pipelines automatically when the remote config changes — no service restart needed. Full walkthrough:Onboard Grafana Alloy via remotecfg →
Optional: add the onboarding agent
The LinkMesh agent is an optional edge connector — install it on a host (or as a Kubernetes DaemonSet) and it auto-detects running services, discovers log sources, and rolls up cluster workloads to make onboarding faster. It carries no telemetry and does not run your collector; your collector still manages itself over OpAMP or remotecfg. Grab it from Downloads.
Episode 1 · 5:47
Watch it end to end
A real walkthrough on two fresh VMs — from a blank machine to a collector reporting into LinkMesh.
LinkMesh Episode 1 — Install the server, enroll your first collector
Next steps on docs.linkmesh.io
Everything beyond the one-liner — UI walkthrough, enrollment tokens, reverse-proxy setup, certificate lifecycle, collector enrollment commands, and troubleshooting — lives in the operator docs. Single source of truth, kept current with each release.
Quickstart
First Collector in 10 minutes
UI walkthrough from blank install to a live route with throughput. With inline screenshots. →
Kubernetes install
Helm chart + manifests
Production deployment with reverse-proxy preset, NetworkPolicy, and TLS termination. →
Enroll a Collector
otelcol via OpAMP, or Alloy via remotecfg
Both enrollment paths with the actual one-liner commands and token lifecycle. →
Reverse proxy
nginx / Caddy / HAProxy
HTTPS termination for the API, UI, OpAMP/remotecfg enrollment, and OTLP — all on port 443. Annotated config. →
Reference
Configuration schema
All config.yaml keys, CLI flags, and the linkmesh-server cert lifecycle commands. →
Troubleshooting
Operational runbooks
Enrollment failures, cert renewal, server IP changes, common mistakes and how to recover. →
Stuck?
Browse the full operator docs, or reach the OpenSight team directly.