Installing and updating Railbase on Linux with apt or dnf

On Linux, Railbase is a package. You can download a .deb or .rpm from your account and install it by hand, but on a server you usually want the opposite: Railbase should update alongside the rest of the machine, under the same policy and the same maintenance window as every other package you run.

That is what the Railbase package repository is for.

What it is

A signed apt and dnf repository, published at railbase.app, carrying the same packages your account can download from the website. Two things about it are worth knowing before you set it up.

It is signed. The repository metadata is signed with the Railbase packaging key. Your machine is told to trust that key once, and from then on apt or dnf refuses anything that was not signed by it — which is what makes an automated apt upgrade safe to run unattended.

It is licensed. Unlike a distribution mirror, this repository is not public. Every request carries a credential tied to your account, and the entitlement is checked on each request rather than once at setup. If the account lapses, updates stop; they do not quietly keep flowing.

Getting a credential

Sign in to your account, open the Deployments section, and create a Linux repository credential. You will see the exact commands to run, with the credential already filled in — copy them to the machine and run them there.

The credential is shown once. If you lose it, create another; if a machine is retired or you suspect a credential has leaked, revoke that one from the same page. Revoking takes effect on the next request, and other machines are not affected.

Give each credential a label ("production servers", "staging") so that the list in your account stays readable a year from now.

Debian and Ubuntu

The setup adds two files: the trusted key, and a source list entry pointing at the repository. After that:

sudo apt update
sudo apt install railbase

and from then on sudo apt upgrade updates Railbase with everything else. Because the key is pinned with signed-by, that trust applies to the Railbase repository only — it does not give the Railbase key authority over any other package on your system.

RHEL, Fedora and Rocky

The dnf setup writes a single .repo file. Both gpgcheck and repo_gpgcheck are enabled: the packages and the repository metadata are verified against the Railbase key.

sudo dnf install railbase

After installing

The package installs Railbase as a systemd service with its data under /var/lib/railbase. Upgrades replace the program and leave the data alone — your .vault file, uploaded files and configuration survive an upgrade, as they must.

To check what you are running:

railbase --version
systemctl status railbase

Unattended upgrades

If you use unattended-upgrades (Debian/Ubuntu) or dnf-automatic, Railbase can be included like any other origin. Whether you should is a judgement about your environment: automatic updates keep security fixes flowing without anyone remembering to act, while a scheduled manual upgrade gives you a moment to read the release notes first. Railbase supports both; it does not decide for you.

If something goes wrong

apt update reports a credential error. The credential was revoked, or the account's entitlement lapsed. Check the Deployments section of your account; a new credential fixes the first case, and the second needs the licence sorted out.

NO_PUBKEY or a signature error. The trusted key was not installed, or was installed somewhere apt is not reading it from. Re-run the key step from your account page.

A version you expect is missing. The repository publishes what your account is entitled to. If a release is out and your machine cannot see it, check the account first — the repository is deliberately not more permissive than the download page.