Install DinaSync

DinaSync 0.1.0 requires a Linux amd64 host with systemd, a working Docker CLI and daemon, and outbound HTTPS access to Codinamo and the container registries used by its targets.

Install the package

Install the latest supported release:

curl -fsSL https://downloads.codinamo.com/dinasync/install.sh | sh

The installer downloads the versioned DEB package, verifies its published SHA-256 digest, and installs it through APT. Review scripts before piping them to a shell when required by your organization’s security policy:

curl -fsSLO https://downloads.codinamo.com/dinasync/install.sh
less install.sh
sh install.sh

To install a pinned release directly:

curl -fsSLO https://downloads.codinamo.com/dinasync/0.1.0/dinasync-0.1.0-linux-amd64.deb
curl -fsSLO https://downloads.codinamo.com/dinasync/0.1.0/dinasync-0.1.0-linux-amd64.deb.sha256
sha256sum --check dinasync-0.1.0-linux-amd64.deb.sha256
sudo apt install ./dinasync-0.1.0-linux-amd64.deb

The package installs /usr/bin/dinasync, /etc/codinamo/dinasync.ice, and dinasync.service. It also creates the service account, state directory, and database-key credential when absent.

The release manifest is available at downloads.codinamo.com/dinasync/latest.json. The TGZ artifact listed there is intended for advanced manual inspection; it does not execute the DEB lifecycle scripts and is therefore not the recommended installation path.

Configuration

DinaSync reads /etc/codinamo/dinasync.ice by default:

ICE-1.0.0
dinasync >= 0.1.0

@agent {
    name: "production-agent"
    serverUrl: "https://codinamo.com"
    stateDirectory: "/var/lib/codinamo/dinasync"
    pollIntervalSeconds: 5
    requestTimeoutSeconds: 30
    allowInsecureHttp: false
}

@storage {
    databaseFile: "/var/lib/codinamo/dinasync/state.db"
    keyCredential: "dinasync.db-key"
}

@tls {
    caBundleFile: ""
    certificateFile: ""
    privateKeyFile: ""
}

Validate it before enrollment:

dinasync --check-config /etc/codinamo/dinasync.ice

Database key

The package creates a raw 32-byte credential outside SQLite. For a manual installation, create it with:

install -d -m 0700 /etc/codinamo/credentials
openssl rand 32 > /etc/codinamo/credentials/dinasync.db-key
chmod 0600 /etc/codinamo/credentials/dinasync.db-key

The systemd unit exposes it with LoadCredential. Keep the source credential at mode 0600 and the state directory at 0700. The key survives restarts and allows DinaSync to decrypt its enrolled identity and durable job state.

Enrollment

In Codinamo, open Targets and issue a short-lived enrollment token.
Deliver the token through bootstrap automation or a secret manager.
Pipe it to dinasync enroll --token-stdin /etc/codinamo/dinasync.ice.
Start and enable dinasync.service after enrollment succeeds.

secret-manager read codinamo/dinasync-enrollment \
  | sudo systemd-run --quiet --wait --pipe --collect \
      --unit=dinasync-enroll --service-type=exec \
      --property=User=dinasync --property=Group=dinasync \
      --property=StateDirectory=codinamo/dinasync \
      --property=LoadCredential=dinasync.db-key:/etc/codinamo/credentials/dinasync.db-key \
      /usr/bin/dinasync enroll --token-stdin /etc/codinamo/dinasync.ice
sudo systemctl enable --now dinasync.service
sudo systemctl status dinasync.service

Do not put enrollment tokens in ICE, command arguments, environment variables, shell history, or SQLite.

The agent processes one job at a time and persists state before performing deployment side effects. After a restart it resumes leased work conservatively and reports unsafe-to-repeat work as failed rather than silently repeating it.