# Installing Nebulai Nebulai runs in infrastructure the customer owns. This guide installs it into a Microsoft Azure subscription from a Mac or Linux machine. Nothing here sends code, questions or credentials to Nebulai. ## Before you start 1. **An agreement.** Sign in at https://account.nebulai.uk with GitHub, create an organisation, and ask Nebulai to record your seats against it. Until that exists, `nebulai install` stops with "no organisation you own has a Team plan with a free installation slot". 2. **An Azure subscription** where you are Owner, or have Contributor plus permission to create role assignments (for example User Access Administrator). The installer grants its backup identity access only to its recovery storage account. Azure bills you directly: roughly US$90 a month running, about US$9 a month paused. 3. **A GitHub account.** During setup you create a GitHub App that you own and choose which repositories it can read. ## Install ```bash brew install azure-cli brew install kaiservermillion/nebulai/nebulai ``` Sign in to your own Azure tenant. This opens a browser; the session stays on your machine and Nebulai never receives an Azure credential. ```bash az login ``` Run the installer. It opens a browser once so you can confirm a short code against your Nebulai account. ```bash nebulai install ``` It then prints what it will create and waits for `y`: ```text Nebulai will create these resources in YOUR subscription (Pay-As-You-Go): Resource group nebulai in eastus Recovery group nebulai-recovery in eastus, retained independently Virtual machine Standard_D2as_v7, Ubuntu 24.04, no inbound SSH Data disk 64 GB, kept if you later uninstall Backup storage encrypted GRS Blob storage, soft delete and versioning enabled Managed identity scoped to write recovery blobs (requires RBAC assignment permission) Public address https://nebulai-3f9a2c11.eastus.cloudapp.azure.com Installation Your Company (team plan) Azure bills you about US$90 a month while it runs. Create these resources now? [y/N] ``` After you accept it runs unattended for about fifteen minutes: deploys two managed resource groups, the VM, and protected recovery storage; then approves it only when the machine's reported Azure identity matches the one just created, loads the runtime images, migrates the database, starts the services, obtains a certificate, creates the first off-host backup, and opens a one-time owner link. Useful flags: `--region westeurope`, `--resource-group NAME`, `--subscription ID`, `--organization aorg_...`, `--name LABEL`, `--yes`. If it is interrupted, run `nebulai install` again. It resumes from the local state or reconstructs that cache from Azure deployment-stack and resource-group metadata; it never builds a second machine. ## Become the administrator The installer opens a one-time link ending in `/claim#claim=...`. It works once and expires ten minutes after approval; the fragment is part of the credential, so the bare address will not work. If the browser did not open, the installer prints the path of a 0600 file holding the link. If it expires, run `nebulai install` again to issue a fresh one. ## Connect your code Admin walks you through creating a GitHub App you own. Name it anything GitHub has not taken, leave the organisation field empty to create it under your own account, approve it on GitHub, then choose the repositories Nebulai may read. The App's keys are stored on your installation. ## Check it works 1. A repository finishes indexing, and a push updates it without being asked. 2. An answer cites the commit, pull request or discussion behind it. 3. The first scheduled backup has an off-host receipt, and a controlled Azure recovery drill has been completed before production use. ## Pause, resume, remove ```bash az vm deallocate -g nebulai -n nebulai-vm az vm start -g nebulai -n nebulai-vm ``` If the VM or other replaceable resources are damaged while the data disk still exists, reconcile them without changing the installation identity: ```bash nebulai repair ``` If the entire workload group and data disk were lost outside the uninstaller, the retained recovery group can rebuild them from the newest verified backup. The exact installation id is a required destructive confirmation: ```bash nebulai repair --from-backup --confirm-installation YOUR_INSTALLATION_ID ``` Remove the installation, keeping the disk that holds your database: ```bash nebulai uninstall ``` This revokes the installation and keeps the disk as recovery data. Revocation is final: the retained disk is not silently rebound to another installation. Remove the workload and database while retaining the independently protected backup archive. It asks you to type the workload group name back: ```bash nebulai uninstall --delete-data ``` Remove the workload, database, and backup archive. It asks you to type both resource group names back; this cannot be undone: ```bash nebulai uninstall --delete-data --delete-backups ``` Licensing is a short lease that renews while the agreement is current. If it lapses, indexing and answering stop, but nothing is deleted: sign-in, export, backup and restore keep working. ## Installing on your own Linux server Requires Docker Engine with Compose v2, encrypted storage, a public DNS name pointing at the host, and ports 80 and 443 reachable. Install the `nebulai` command as above, then run these as root on that host: ```bash nebulai doctor --mode team --hostname YOUR_HOSTNAME --storage-encrypted nebulai setup --mode team --hostname YOUR_HOSTNAME --storage-encrypted ``` `doctor` changes nothing and reports what would stop the install. `setup` prints a short code and pauses until you approve it at https://account.nebulai.uk, then continues to the same owner link. Rerunning `setup` resumes rather than starting over. For assessment on a laptop, `--mode evaluation` serves on http://localhost:4300 with no DNS name and no open ports. GitHub cannot reach it, so sources are refreshed by hand.