# Installing and updating Railbase on Linux with apt or dnf

> Railbase publishes a signed, licensed package repository, so a Linux server installs and updates it the same way it updates everything else on the machine.

_Updated: 2026-08-19_

On Linux, Railbase is a package. You can download a `.deb` or `.rpm` from your
account and install it by hand, but on a server you usually want the opposite:
Railbase should update alongside the rest of the machine, under the same policy
and the same maintenance window as every other package you run.

That is what the Railbase package repository is for.

## What it is

A signed apt and dnf repository, published at `railbase.app`, carrying the same
packages your account can download from the website. Two things about it are
worth knowing before you set it up.

**It is signed.** The repository metadata is signed with the Railbase packaging
key. Your machine is told to trust that key once, and from then on apt or dnf
refuses anything that was not signed by it — which is what makes an automated
`apt upgrade` safe to run unattended.

**It is licensed.** Unlike a distribution mirror, this repository is not public.
Every request carries a credential tied to your account, and the entitlement is
checked on each request rather than once at setup. If the account lapses,
updates stop; they do not quietly keep flowing.

## Getting a credential

Sign in to your account, open the **Deployments** section, and create a Linux
repository credential. You will see the exact commands to run, with the
credential already filled in — copy them to the machine and run them there.

The credential is shown once. If you lose it, create another; if a machine is
retired or you suspect a credential has leaked, revoke that one from the same
page. Revoking takes effect on the next request, and other machines are not
affected.

Give each credential a label ("production servers", "staging") so that the list
in your account stays readable a year from now.

## Debian and Ubuntu

The setup adds two files: the trusted key, and a source list entry pointing at
the repository. After that:

```
sudo apt update
sudo apt install railbase
```

and from then on `sudo apt upgrade` updates Railbase with everything else.
Because the key is pinned with `signed-by`, that trust applies to the Railbase
repository only — it does not give the Railbase key authority over any other
package on your system.

## RHEL, Fedora and Rocky

The dnf setup writes a single `.repo` file. Both `gpgcheck` and `repo_gpgcheck`
are enabled: the packages **and** the repository metadata are verified against
the Railbase key.

```
sudo dnf install railbase
```

## After installing

The package installs Railbase as a systemd service with its data under
`/var/lib/railbase`. Upgrades replace the program and leave the data alone —
your `.vault` file, uploaded files and configuration survive an upgrade, as they
must.

To check what you are running:

```
railbase --version
systemctl status railbase
```

## Unattended upgrades

If you use `unattended-upgrades` (Debian/Ubuntu) or `dnf-automatic`, Railbase
can be included like any other origin. Whether you *should* is a judgement about
your environment: automatic updates keep security fixes flowing without anyone
remembering to act, while a scheduled manual upgrade gives you a moment to read
the release notes first. Railbase supports both; it does not decide for you.

## If something goes wrong

**`apt update` reports a credential error.** The credential was revoked, or the
account's entitlement lapsed. Check the Deployments section of your account; a
new credential fixes the first case, and the second needs the licence sorted
out.

**`NO_PUBKEY` or a signature error.** The trusted key was not installed, or was
installed somewhere apt is not reading it from. Re-run the key step from your
account page.

**A version you expect is missing.** The repository publishes what your account
is entitled to. If a release is out and your machine cannot see it, check the
account first — the repository is deliberately not more permissive than the
download page.