# Installing Nodeau

## What you need, and what you do not

You need `curl`, `tar`, a SHA-256 tool, and an NVIDIA GPU with a working
driver.

You do **not** need a GitHub account, a personal access token, a Nodeau
account, a licence key or an invitation. Every fetch in the install path is
public and anonymous:

| Step | Fetches | From |
|---|---|---|
| `install.sh` | the CLI archive and its checksum | `get.nodeau.ai` |
| `nodeau install` | the controller and agent images | a public container registry |
| `nodeau quickstart` | the model weights | the model's own publisher |

If anything asks you to authenticate in order to install Nodeau, that is a bug.
Please report it rather than working around it — see [support](support.md).

## Before you start

Run this and confirm it prints a table:

```bash
nvidia-smi
```

If it does not, stop here and install your NVIDIA driver first. Nodeau does not
manage your driver — see [requirements](requirements.md).

## Step 1 — get the binary

```bash
curl -fsSL https://get.nodeau.ai/install.sh | bash
```

Or, to read it first:

```bash
curl -fsSL https://get.nodeau.ai/install.sh -o install-nodeau.sh
less install-nodeau.sh
bash install-nodeau.sh
```

This installs one binary to `~/.local/bin/nodeau`. It runs as you, refuses to
run as root, and changes nothing else.

To reproduce an exact earlier install:

```bash
NODEAU_VERSION=v0.1.0-alpha.1 bash install-nodeau.sh
```

## Step 2 — check the machine

```bash
nodeau doctor
```

Read-only. Nothing is changed. It reports your OS, GPU, driver, container
runtime, Kubernetes, VRAM capacity and model cache, and tells you what to do
about anything that is missing.

`nodeau doctor --json` gives the same information in a stable machine-readable
form.

## Step 3 — set up Nodeau

```bash
nodeau install
```

It shows a plan and waits for you. The plan names every component, whether it
is already present, what Nodeau intends to do about it, and — just as
importantly — what it will not touch. Every command that needs `sudo` is
printed in full before you are asked, so nothing surprises you halfway through.

### What it installs when it is missing

| Component | |
|---|---|
| NVIDIA Container Toolkit | pinned version, from NVIDIA's official repository. The signing key is verified against a known fingerprint before it is trusted, and the package transaction is simulated and screened first. |
| K3s | pinned version. The release binary is downloaded and checked against a SHA-256 compiled into the Nodeau binary before anything runs it — no install script is fetched and piped into a shell. |
| NVIDIA device plugin | what makes your GPU an allocatable Kubernetes resource. |
| Nodeau's control plane | its custom resources, RBAC, controller and node agent. |

Every Kubernetes manifest is compiled into the `nodeau` binary. There is no
checkout to clone, no `kubectl` to run, and nothing to download from a source
repository.

### What it adopts instead of installing

If any of those is already on your machine, Nodeau **uses it as it found it**
and writes that down. That record is what makes uninstall safe: Nodeau removes
only what Nodeau installed, and refuses to remove anything else even if you ask.

If a Kubernetes cluster is already reachable, Nodeau adopts it. It will not
install K3s alongside it, will not reconfigure it, and will never delete it.

### What it will never do

- install, upgrade, replace or remove your **NVIDIA driver**
- disable **Secure Boot** or enrol keys
- modify your **bootloader** or kernel command line
- touch a partition, or mount NTFS
- delete a **Kubernetes cluster it did not create**
- open any port beyond `127.0.0.1`

A working NVIDIA driver is a prerequisite. If `nvidia-smi` does not print a
table, Nodeau stops and tells you — that decision affects whether your machine
boots to a desktop, and it is yours to make.

### Options

```bash
nodeau install --dry-run          # show the plan and every command, change nothing
nodeau install --print-manifests  # print every manifest compiled into the binary
nodeau install --server-dry-run   # send the manifests to Kubernetes for validation, discard them
nodeau install --yes              # skip the confirmation
nodeau install --skip-k3s         # you will provide the cluster yourself
```

Running it again is safe. It re-checks everything, skips what is done, does not
regenerate your API key, and never re-decides who owns a component.

## Step 4 — run a model

```bash
nodeau quickstart
```

This picks the starter model, tells you its size and licence, asks before
downloading, waits for it to load, starts the local endpoint and prints a
working curl command.

## Reinstalling

Running `nodeau install` again is safe. It detects what is already there,
verifies it, and does not duplicate configuration, regenerate your API key or
re-download models.

## Where things live

| Path | What |
|---|---|
| `~/.local/bin/nodeau` | The CLI |
| `~/.config/nodeau/` | Your API key |
| `~/.local/state/nodeau/` | Endpoint state and install logs |
| `~/.config/systemd/user/` | The local endpoint's user service |
| `/var/lib/nodeau/models/` | Model cache |
| `/var/lib/nodeau/install-state.json` | What Nodeau installed, for safe uninstall |