Install on Linux

This guide takes a Linux host to a Priompt server that runs as a hardened systemd service under its own user. It works on any distribution with systemd, such as Debian, Ubuntu, RHEL, Fedora, or Arch, on amd64 or arm64. To run the server in a container instead, see Install with Docker.

Prerequisites

Before you begin, make sure you have:

• A Linux host with systemd: amd64 or arm64.
• sudo: the steps create a user, directories, and a service.
• curl: to download Go in step 1.

1. Build the binary

Priompt builds with Go 1.25 or later. Distribution packages often lag behind, so install Go from go.dev.

To build and install the priompt binary:

1. Install the latest Go release. On arm64, replace linux-amd64 with linux-arm64:

   GO=$(curl -s 'https://go.dev/VERSION?m=text' | head -1)
   curl -LO "https://go.dev/dl/$GO.linux-amd64.tar.gz"
   sudo rm -rf /usr/local/go && sudo tar -C /usr/local -xzf "$GO.linux-amd64.tar.gz"
   export PATH=$PATH:/usr/local/go/bin

2. Build priompt into the current directory. No clone is needed:

   CGO_ENABLED=0 GOBIN=$PWD go install github.com/priompt/priompt/cmd/priompt@latest

3. Install it and check the version:

   sudo install -m 0755 priompt /usr/local/bin/priompt
   priompt version

   Output

   priompt v0.7.4 (commit unknown, go1.25.14)

   The Go version in the output is the one you built with.

2. Create a service user and directories

To create the account and directories the service uses:

1. Create a system user with no login shell:

   sudo useradd --system --home /var/lib/priompt --shell /usr/sbin/nologin priompt

2. Create the data directory, which holds the database, and the configuration directory, which holds the secrets:

   sudo install -d -o priompt -g priompt -m 0750 /var/lib/priompt
   sudo install -d -o root -g priompt -m 0750 /etc/priompt

3. Generate credentials

To create the admin token, the NATS token, and the encryption key:

1. Create the tokens file with an admin token:

   sudo priompt init -tokens-file /etc/priompt/tokens.txt -addr "$(hostname -f):8443"

   Output

   wrote admin token to /etc/priompt/tokens.txt
   
     start server:  priompt serve -tokens-file /etc/priompt/tokens.txt
     point client:  export PRIOMPT_URL=priompt://<token>@<your-host>:8443

   Keep the PRIOMPT_URL line. Clients use it in step 6.

2. Write the service's environment file:

   sudo tee /etc/priompt/priompt.env >/dev/null <<EOF
   PRIOMPT_SEED=false
   PRIOMPT_NATS_TOKEN=$(priompt gen-token)
   PRIOMPT_ENCRYPTION_KEY=$(head -c32 /dev/urandom | base64)
   EOF

   PRIOMPT_NATS_TOKEN is the broker's own credential. Keep it on the server: agents subscribe with their API token, as in nats://<token>@<your-host>:4222. PRIOMPT_ENCRYPTION_KEY encrypts prompts at rest and is optional.

3. Let the service user read the files, and nobody else:

   sudo chown root:priompt /etc/priompt/* && sudo chmod 0640 /etc/priompt/*

Back up the encryption key

Without the key, the database can't be read. Store PRIOMPT_ENCRYPTION_KEY in your password manager or secret store, separately from the backups.

4. Install the systemd unit

To run the server as a service:

1. Save the unit file:

   /etc/systemd/system/priompt.service

   [Unit]
   Description=Priompt prompt server
   After=network-online.target
   Wants=network-online.target
   
   [Service]
   User=priompt
   Group=priompt
   EnvironmentFile=/etc/priompt/priompt.env
   WorkingDirectory=/var/lib/priompt
   ExecStart=/usr/local/bin/priompt serve \
     -addr :8443 \
     -db /var/lib/priompt/priompt.db \
     -tokens-file /etc/priompt/tokens.txt \
     -nats-addr 0.0.0.0:4222 \
     -metrics-addr 127.0.0.1:2112
   Restart=on-failure
   RestartSec=2
   
   # Hardening
   NoNewPrivileges=true
   ProtectSystem=strict
   ProtectHome=true
   PrivateTmp=true
   ReadWritePaths=/var/lib/priompt
   
   [Install]
   WantedBy=multi-user.target

2. Start the service and enable it at boot:

   sudo systemctl daemon-reload
   sudo systemctl enable --now priompt

3. Check its status:

   systemctl status priompt

   Output

   ● priompt.service - Priompt prompt server
        Loaded: loaded (/etc/systemd/system/priompt.service; enabled; preset: enabled)
        Active: active (running) since Sun 2026-10-18 04:49:47 UTC; 2s ago
      Main PID: 4305 (priompt)
   ...
   Oct 18 04:49:47 prompts priompt[4305]: 2026/10/18 04:49:47 priompt v0.7.4 (unknown) serving on :8443 (tls=false mtls=false auth=1-token cache=mem embed=lexical(offline) nats=0.0.0.0:4222 metrics=127.0.0.1:2112 ratelimit=0/s)
   Oct 18 04:49:47 prompts priompt[4305]: 2026/10/18 04:49:47 metrics on 127.0.0.1:2112/metrics

The server writes one JSON audit line per request to the journal. Follow it with journalctl -u priompt -f. To add TLS, append -tls-cert and -tls-key to ExecStart. See Secure a server.

5. Open the firewall

Open 8443 for clients. Open 4222 only if agents on other hosts subscribe to change events. Leave 2112 (metrics) closed and scrape it from inside your network.

ufw (Debian, Ubuntu)

sudo ufw allow 8443/tcp
sudo ufw allow 4222/tcp

firewalld (RHEL, Fedora)

sudo firewall-cmd --permanent --add-port=8443/tcp --add-port=4222/tcp
sudo firewall-cmd --reload

6. Connect a client

To publish a first prompt and read it back:

1. Point the CLI at the server with the PRIOMPT_URL from step 3:

   export PRIOMPT_URL=priompt://<token>@<your-host>:8443

2. Publish a prompt:

   echo 'Welcome to {org}, {name}! Ask me anything to get started.' | priompt publish -uri priompt://acme/onboarding/welcome -file - -slot name -slot org

   Output

   published priompt://acme/onboarding/welcome (9ae06087ed69) — subscribers notified

3. List the prompts:

   priompt list

   Output

   priompt://acme/onboarding/welcome	9ae06087ed69

Both SDKs read PRIOMPT_URL when you create a client without arguments, so the same variable connects your agents.

Python

To fetch the prompt from Python:

1. Install the SDK:

   pip install priompt-sdk

2. Save this script as connect.py:

   connect.py

   from priompt_sdk import PromptClient
   
   client = PromptClient()  # reads PRIOMPT_URL
   prompt = client.get("priompt://acme/onboarding/welcome")
   print(prompt.template)

3. Run it with python connect.py.

   Output

   Hi {name}, welcome to {org}!

Node

To fetch the prompt from Node:

1. Install the SDK:

   npm install @priompt/client

2. Save this script as connect.js:

   connect.js

   const { PromptClient } = require("@priompt/client");
   
   async function main() {
     const client = new PromptClient(); // reads PRIOMPT_URL
     const prompt = await client.get("priompt://acme/onboarding/welcome");
     console.log(prompt.template);
     client.close();
   }
   
   main();

3. Run it with node connect.js.

   Output

   Hi {name}, welcome to {org}!

Upgrade

To upgrade to a new release:

1. Build the new binary, as in step 1:

   CGO_ENABLED=0 GOBIN=$PWD go install github.com/priompt/priompt/cmd/priompt@latest

2. Back up the database. The environment file carries the encryption key that the backup needs:

   sudo sh -c 'set -a; . /etc/priompt/priompt.env; priompt backup -db /var/lib/priompt/priompt.db -out /var/lib/priompt/pre-upgrade.jsonl'

   Output

   backed up 1 prompts, 1 commits, 1 branch pointers

3. Replace the binary and restart. Pending schema migrations run on start:

   sudo install -m 0755 priompt /usr/local/bin/priompt
   sudo systemctl restart priompt

Uninstall

To remove the service, the binary, and all data:

1. Stop and remove the service and the binary:

   sudo systemctl disable --now priompt
   sudo rm /etc/systemd/system/priompt.service /usr/local/bin/priompt

2. Delete the configuration and data, then the user. This deletes every prompt, so back up first:

   sudo rm -r /etc/priompt /var/lib/priompt
   sudo userdel priompt

Next steps

• Production checklist: set what a server needs before it takes real traffic.
• Secure a server: add TLS and scoped tokens.
• Client SDKs: use Priompt from your agents.