Install

This page shows how to build lasboltd and lasboltctl and run them as a service on Linux. To install the lasbolt command line client or an app, see Apps.

There is no release yet. No archive, package or container image exists to download. Build from source. When releases start, the archives will be named <program>_<version>_<os>_<arch>.tar.gz, with a SHA256SUMS file. The binaries will not be signed.

Build from source

You need Go 1.27, make and git. The repository is not public yet, so you need access to the project to clone it.

git clone https://gitlab.com/lasbolt/lasbolt.git
cd lasbolt
make build

make build makes these files in bin/:

File	Purpose
`lasboltd`	The server. It has the web app inside.
`lasboltctl`	The control tool for a running server.
`lasbolt`	The command line client. The server host does not need it.

Check the build:

bin/lasboltd version

The output has the version, the commit, the build date and the Go version. To build for a Linux server from another system, set GOOS=linux GOARCH=amd64. The make release target builds all platforms into dist/.

Install the programs

Copy the binaries

sudo install -m 0755 bin/lasboltd bin/lasboltctl /usr/local/bin/

Make a user and the folders

The service runs as its own user. This user has no login shell.

sudo useradd --system --home-dir /var/lib/lasbolt --shell /usr/sbin/nologin lasbolt
sudo install -d -m 0700 -o lasbolt -g lasbolt /var/lib/lasbolt
sudo install -d -m 0750 -o root -g lasbolt /etc/lasbolt

/var/lib/lasbolt is the data folder. Only lasbolt can read it. /etc/lasbolt holds the settings file and the key file.

Make the unseal secret

The server needs a secret at each start. See Sealing and keys to choose. This example uses a passphrase file:

sudo sh -c 'umask 077; head -c 32 /dev/urandom | base64 > /etc/lasbolt/passphrase'
sudo chown lasbolt:lasbolt /etc/lasbolt/passphrase

lasboltd refuses a secret file that group or others can read. Make a copy of the passphrase and keep it away from the server. If you lose it, nobody can open the data.

Write the settings file

Create /etc/lasbolt/lasboltd.env. The service reads it. It has no secret in it, only paths and addresses.

LASBOLT_ADDR=127.0.0.1:8080
LASBOLT_DATA_DIR=/var/lib/lasbolt
LASBOLT_UNSEAL_PASSPHRASE_FILE=/etc/lasbolt/passphrase
LASBOLT_TRUSTED_PROXY=127.0.0.1/32
LASBOLT_PUBLIC_URL=https://vault.example.org
LASBOLT_CTL_SOCKET=/run/lasbolt/ctl.sock

sudo chown root:lasbolt /etc/lasbolt/lasboltd.env
sudo chmod 0640 /etc/lasbolt/lasboltd.env

See Configuration for the meaning of each line.

Install the systemd unit

Create /etc/systemd/system/lasboltd.service:

[Unit]
Description=Lasbolt server (lasboltd)
After=network-online.target
Wants=network-online.target

[Service]
User=lasbolt
Group=lasbolt
EnvironmentFile=/etc/lasbolt/lasboltd.env
ExecStart=/usr/local/bin/lasboltd
Restart=on-failure
RestartSec=2
UMask=0077

# Sandbox. See "Hardening".
NoNewPrivileges=true
CapabilityBoundingSet=
AmbientCapabilities=
ProtectSystem=strict
ReadWritePaths=/var/lib/lasbolt
RuntimeDirectory=lasbolt
RuntimeDirectoryMode=0700
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectKernelLogs=true
ProtectControlGroups=true
ProtectClock=true
ProtectHostname=true
ProtectProc=invisible
ProcSubset=pid
LockPersonality=true
MemoryDenyWriteExecute=true
RestrictRealtime=true
RestrictSUIDSGID=true
RestrictNamespaces=true
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
SystemCallArchitectures=native
SystemCallFilter=@system-service
SystemCallErrorNumber=EPERM

[Install]
WantedBy=multi-user.target

RuntimeDirectory=lasbolt makes /run/lasbolt for the control socket. systemd removes it when the service stops.

Start the service

sudo systemctl daemon-reload
sudo systemctl enable --now lasboltd
sudo systemctl status lasboltd

Check it

sudo -u lasbolt lasboltctl status
curl -I http://127.0.0.1:8080/

lasboltctl status shows state: unsealed. The curl command shows 303 See Other with Location: /login.

Do not use --dev on a real server. It uses a key that is public in the source code, and it accepts the loopback address only.

Data folder

Path	Content	Mode
`lasbolt.db` (and `-wal`, `-shm`)	The database	0600
`backups/`	Scheduled backups	0700
`lasbolt.db.before-restore-<time>`	The old database, after a restore	0600

The service user must own the folder. Do not put the folder on a network file system: SQLite needs working file locks.

Next steps

Put a TLS proxy in front.
Make the first owner.
Set up backups.

Last updated on 2026-10-21

TLS and reverse proxy