Install a collector

The collector is the on-prem half of kilasec. It runs on a LAN host (a small Linux box, VM, NUC, or Pi) and does three things:

1. mitmproxy on :8080 — TLS-decrypts AI traffic from clients that route through it.
2. Policy engine (PDP) on 127.0.0.1:8000 — evaluates every request against your rules and emits a verdict.
3. PAC server on :9443 — serves the proxy auto-config so DHCP can hand it to clients automatically.

No raw payloads leave the customer's network. The cloud only sees the decision (with redaction already applied at the collector).

Requirements

	Minimum
OS	Linux with systemd (amd64 or arm64). The installer is systemd-based — macOS is not supported as a collector host.
Docker	24+ — installed automatically if missing (apt or dnf). Bring your own with --no-install-docker.
Network	outbound HTTPS to kilasec.com and ghcr.io; no inbound ports need opening
Memory	~1 GB for a light load; 2 GB+ recommended
Storage	2 GB for image + ~50 MB/day for local audit logs

Check compatibility first (optional)

Before spending an enrollment code, run the read-only compatibility check — it verifies DNS, TLS to the cloud, Docker, and that ports 8080/9443 are free, and installs nothing:

curl -fsSL https://kilasec.com/install | sh -s -- --diagnose

One-liner

The simplest path — paste this into a fresh shell on the collector host:

curl -fsSL https://kilasec.com/install | sh -s -- --enroll <enrollment-code>

What that does, in order:

0. Ensures Docker is present — installs it (apt/dnf) if missing. When run interactively it asks first; piped from curl it proceeds automatically. Use --no-install-docker to refuse.
1. Reads --enroll <code>, POSTs it to /api/v1/collectors/enroll.
2. Receives a per-collector token + the registry creds for the docker image.
3. Writes /etc/kilasec/collector.env (mode 600).
4. docker login to GHCR, then docker pull ghcr.io/blox-24/kilasec-collector.
5. Installs kilasec-collector.service as a systemd unit, enables, starts.
6. Polls /api/v1/collectors/{id}/status until the cloud sees its first heartbeat (or 60s).

You'll see something like:

✓ enrolled with cloud (collector_id=col_4f81…)
✓ pulled image kilasec-collector:latest
✓ wrote /etc/systemd/system/kilasec-collector.service
✓ collector reachable at http://localhost:8080
✓ cloud sees the collector — you're online.

Manual install (no curl-to-shell)

If you don't want to pipe a shell script:

# 1. Enroll manually.
curl -X POST https://kilasec.com/api/v1/collectors/enroll \
  -H "Content-Type: application/json" \
  -d '{"code": "<enrollment-code>", "hostname": "'$(hostname)'", "platform": "linux"}'
# → {token, collector_id, registry: {user, password}, image}

# 2. Save the token (mode 600, root-only).
sudo install -d -m 700 /etc/kilasec
echo "AGENTFW_CLOUD_URL=https://kilasec.com"          | sudo tee /etc/kilasec/collector.env >/dev/null
echo "AGENTFW_CLOUD_TOKEN=<token-from-response>"     | sudo tee -a /etc/kilasec/collector.env >/dev/null
sudo chmod 600 /etc/kilasec/collector.env

# 3. Pull the image.
echo "<password>" | docker login ghcr.io -u <user> --password-stdin
docker pull ghcr.io/blox-24/kilasec-collector:latest

# 4. Run.
docker run -d --name kilasec-collector --restart always \
  --env-file /etc/kilasec/collector.env \
  -p 8080:8080 -p 9443:9443 \
  -v /var/lib/kilasec:/var/lib/kilasec \
  ghcr.io/blox-24/kilasec-collector:latest

Verify

# Reach the PDP locally (should be loopback-only):
curl http://127.0.0.1:8000/healthz
# {"ok": true, ...}

# Reach the proxy port from another LAN host:
curl --proxy http://<collector-ip>:8080 https://api.openai.com -o /dev/null -w "%{http_code}\n"
# 200 (or whatever; the point is the connection works)

The collector should now appear on the cloud dashboard under Collectors with a fresh last_seen_at.

Where the collector keeps state

• /var/lib/kilasec/.mitmproxy/ — the per-connection signing CA. Mount this volume so it survives container restarts; otherwise a restart breaks every client that trusted the old cert.
• /var/lib/kilasec/audit.log.jsonl — local audit log. Cloud has the canonical copy via ingest; this is just a tail.

Common installer flags

• --enroll <code> — one-time enrollment code from your kilasec admin.
• --token <api_token> — skip enrollment; use a pre-issued token directly (rare).
• --registry-user / --registry-pass — override GHCR creds.
• --image <ref> — pull a specific tag (e.g. :v0.7.2) instead of :latest.
• --no-systemd — skip the systemd unit; you'll start the container manually.

Uninstall

Deleting a collector in the dashboard removes its cloud row and signals it to stop, but doesn't clean the host. To remove it from the machine — service, container, and state — run one command there:

curl -fsSL https://kilasec.com/uninstall | sudo sh

That also clears the .shutdown sentinel a dashboard-deleted collector leaves behind, so the host is ready for a clean re-enroll. Add --keep-data to remove the service + container but leave /var/lib/kilasec and /etc/kilasec in place.

→ Once the collector is up, point traffic at it and watch Live Traffic.