Skip to content
Nebulai
Private betaBook a demo

Install Nebulai in infrastructure you own.

Nebulai runs in your own cloud account, on a machine you hold. Your code, your database and your backups stay there. Installing it is two commands and about fifteen minutes of waiting, and you are never asked to configure a server, a certificate or a firewall.

Start hereRead as Markdown

Handing this to a coding agent? Point it at /docs/install.md for the same steps as plain text, or /llms.txt for what this product is and what it will not let a command do on its own.

What you need

Three things. You can line all of them up before you install anything.

  1. An agreement with us

    Sign in to your Nebulai account with GitHub, create your organisation, and tell us its name. We record the seats and installations you have agreed. Until that is recorded the installer will politely refuse, which is how you know nobody can quietly run up a bill in your name.

  2. A Microsoft Azure subscription

    An Azure account with a payment method, where you can create resources. Your Azure user must be an Owner, or have Contributor plus permission to create the one narrowly scoped backup role assignment. Azure bills you directly for the machine Nebulai runs on — roughly US$90 a month while it is running, and about US$9 a month if you pause it. We never see your Azure login, and we cannot create anything in your account: the installer uses the session on your own computer.

  3. A GitHub account for the code you want indexed

    Near the end, Nebulai walks you through creating a GitHub App that belongs to you, and you choose which repositories it can see. Its keys live on your installation. We never hold a key to your code.

What we hold is deliberately small: your organisation, what you have agreed, and which installations exist. Not your repositories, your questions, or your answers.

Install it

Everything happens on your own computer — a Mac or a Linux machine. You will type two commands, sign in twice in your browser, and answer one question.

  1. Install the two tools

    The first line installs Microsoft's Azure command, which is how your computer talks to your own Azure account. The second installs nebulai. Both come from their publishers, and Homebrew checks each download against a published fingerprint before it runs.

    brew install azure-cli
brew install kaiservermillion/nebulai/nebulai

    No Homebrew? Install it first from brew.sh — one line, and it is the standard way to install developer tools on a Mac.

  2. Sign in to Azure

    This opens your browser and signs you in to Microsoft, exactly as any other Azure sign-in. The result stays on your computer.

    az login

  3. Run the installer

    This is the whole installation. It opens your browser once to confirm a short code against your Nebulai account, so we know the request is really you.

    nebulai install

  4. Read the confirmation, then say yes

    Before anything is created, the installer prints exactly what it will build in your subscription and what Azure will charge for it. Nothing exists until you answer y.

    Nebulai will create these resources in YOUR subscription (Pay-As-You-Go):
  Resource group  nebulai in eastus
  Recovery group  nebulai-recovery in eastus, retained independently
  Virtual machine Standard_D2as_v7, Ubuntu 24.04, no inbound SSH
  Data disk       64 GB, kept if you later uninstall
  Backup storage  encrypted GRS Blob storage, soft delete and versioning enabled
  Managed identity scoped to write recovery blobs (requires RBAC assignment permission)
  Public address  https://nebulai-3f9a2c11.eastus.cloudapp.azure.com
  Installation    Your Company (team plan)

Azure bills you about US$90 a month while it runs.
Create these resources now? [y/N]

    In plain terms: one small Linux machine, one disk that holds your data and survives the machine being replaced, protected backup storage in a separate Azure group, and a fixed web address with a real certificate. No remote-login port is opened at all.

  5. Wait about fifteen minutes

    The installer builds the machine, proves to your account that this specific machine is the one it just created, downloads the software, sets up the database, starts everything, asks for the certificate, and publishes the first recovery set outside the workload group. It prints each step as it goes. You do not need to do anything.

    Interrupted? Close the laptop, lose your connection, change your mind — run nebulai install again and it picks up where it stopped. It never builds a second machine by accident.

Want it somewhere other than the default? --region westeurope chooses a different part of the world, and --resource-group NAME changes the folder Azure keeps it in. The installer checks the region can actually fit the machine before it creates anything, and names an alternative if it cannot.

Become the administrator

When the installation is ready, your browser opens on a one-time link that makes you its first administrator. This is the one step with a clock on it.

  1. Open the link it gives you

    It opens by itself. If your browser did not appear, the installer prints the path of a file containing the link — open that. The whole link matters, including the part after the #; the address alone will not work.

  2. Within ten minutes

    The link works once and expires after ten minutes. That is deliberate: it is what stops anyone else who briefly sees your screen becoming the administrator of your installation.

  3. If you miss it, nothing is lost

    Run nebulai install again. It issues a fresh link and opens it. Missing the window costs a minute, not an installation.

Connect your code

Nebulai now walks you through creating a GitHub App — a connection GitHub itself controls, owned by you, that can read only the repositories you pick.

  1. Give it a name

    Anything you like, as long as no one on GitHub has taken it. Leave the organisation box empty to create it under your own account.

  2. Approve it on GitHub

    GitHub shows you exactly what the App may do — read code, pull requests and metadata, nothing more — and returns you to your installation, which stores the keys itself.

  3. Choose repositories

    Pick the repositories Nebulai should learn from. You can add or remove them at any time on GitHub, and Nebulai follows that immediately.

  4. Invite your team

    Everyone signs in with GitHub. The seats we recorded for you are enforced here, so you always know where you stand.

Check it works

Three checks, in order. Do not hand it to your team until all three pass.

  1. A repository finishes indexing

    Add a repository and watch it complete on the project page. Then push a change and confirm Nebulai picks it up without being asked.

  2. An answer cites where it came from

    Ask a question from the project page. The answer should name the commit, pull request or discussion behind it. An answer with nothing behind it is a failure, not a partial success.

  3. A backup restores

    Confirm the scheduled backup has an off-host receipt, then complete a controlled Azure loss-and-recovery drill before production use. A backup nobody has ever restored is a hope, not a plan.

Pause, resume, remove

You are renting a machine from Azure, so the useful thing to know is how to stop paying for it.

  1. Pause it

    Stops the machine and the hourly charge. Your data stays where it is, costing a few dollars a month, and starting it again brings everything back by itself.

    az vm deallocate -g nebulai -n nebulai-vm
az vm start -g nebulai -n nebulai-vm

  2. Repair replaceable resources

    If the machine or network is damaged but the data disk remains, this reconciles the Azure deployment stack and reattaches the verified disk.

    nebulai repair

    If the whole workload group was lost outside the uninstaller, the separate recovery group can recreate the disk from the latest verified backup. Use nebulai repair --from-backup --confirm-installation YOUR_INSTALLATION_ID with the exact id printed in your installation state.

  3. Remove it, but keep your data

    Deletes the machine and its networking, keeps the disk holding your database as recovery data, and revokes the installation. Revocation is final, so a fresh installation cannot silently adopt that disk.

    nebulai uninstall

  4. Remove the workload and database

    Deletes the data disk too, but keeps the independently protected backup archive. It asks you to type the workload group name back.

    nebulai uninstall --delete-data

  5. Remove the backup archive too

    This final teardown asks you to type both Azure group names. It removes the workload, database, and protected recovery storage and cannot be undone.

    nebulai uninstall --delete-data --delete-backups

Your licence is a short lease that renews by itself while your agreement is current. If it lapses, indexing and answering stop — but nothing is deleted and nothing is locked away. Sign-in, export and backup keep working, so you can always take your data with you.

Never send private keys, tokens or code to support. If we ask for logs, your installation redacts them before they leave it.

Your own Linux server

If your team already runs its own servers and would rather not use Azure, Nebulai installs onto a Linux host you provide. This path assumes someone comfortable with a terminal.

You need Docker Engine with Compose v2, encrypted storage, a public DNS name pointing at the host, and ports 80 and 443 reachable. Install the nebulai command as above, then, as root on that host:

nebulai doctor --mode team --hostname YOUR_HOSTNAME --storage-encrypted
nebulai setup --mode team --hostname YOUR_HOSTNAME --storage-encrypted

doctor changes nothing; it reports what would stop the install. setup prints a short code and pauses: approve it in your Nebulai account, and it continues to the same owner link described above. If it stops partway, run the same command again and it resumes.

Evaluating on a laptop instead? --mode evaluation runs the same software at http://localhost:4300 with no DNS name and no open ports. It is for assessment only: GitHub cannot reach it to send updates, so you refresh sources by hand.