Get started

From nothing to a patched server in an afternoon.

Marshal runs on one Linux host with Docker Compose: the web console, the agent API, a worker, PostgreSQL and nightly backups. Free needs no license.

Console hostLinux with Docker and Compose, and a DNS name

NetworkPort 8443 reachable from servers, or through a proxy

Each serverOutbound HTTPS only. No inbound ports, no domain trust

01
Run the installer

On the Linux host (x86-64) that will run Marshal, with ports 80, 443 and 8443 free. It installs Docker if it’s missing, sets up /opt/marshal with generated secrets, gets a certificate and starts Marshal. No account needed: Marshal runs Free until you bind it to your organisation.
```
curl -fsSL https://marshalpatch.com/install.sh | sudo sh
# no questions: --hostname marshal.contoso.com --email [email protected] --yes
# LAN-only host: --internal-tls instead of --email
```
Create the first admin

Open the address the installer printed and enter its setup token (marshalctl setup-token shows it again). Signing in for the first time sets up an authenticator app (MFA is mandatory).

Keep it current

marshalctl backs up the database before it upgrades. Agents update themselves from the console.

marshalctl upgrade    # the latest release
marshalctl status     # what runs, which version
marshalctl backup     # a database backup now

04
Add a customer, then servers

Create the customer, pick tags, and make an install link. Paste the one-liner on each server. It shows up within a minute, awaiting approval.
```
irm https://[your-console]/install/[token] | iex
```
```
curl -fsSL https://[your-console]/install/[token]/linux | sudo sh
```
Run in an elevated PowerShell. For GPO, Intune or an RMM tool, the console also gives you the msiexec line.

Ubuntu, Debian and the RHEL family on amd64 or arm64. Needs systemd, curl, and apt or dnf.
Approve, set windows, and let it run

Approve the server and its first scan starts. Approve updates in the catalogue (or set the Linux policy), add an install window and a reboot window, and runs start by themselves.

Back up the keys, once

None of them is in the database backups. Copy /opt/marshal/data/keys somewhere safe and offline. Settings shows each key’s fingerprint, so you can check a copy matches.

vault/master.key

Without it you re-enter notification secrets and re-enrol MFA.

agent-api/ca.key, ca.crt

Every agent pins this CA. Without it, every agent must be reinstalled.