Install & deploy

Rilbo is one self-contained binary: web UI, REST API, MCP server, migrations and assets included. There is no Node, database server or container runtime to install — SQLite is embedded.

Binary

curl -fsSL https://rilbo.com/install.sh | sh

Or grab a prebuilt archive from the download page and put rilbo somewhere on your PATH. First run:

rilbo serve            # setup wizard, then the UI on http://127.0.0.1:7373

Useful flags and environment:

Verify a download

For a release that publishes signatures, download the archive you need together with its sibling .minisig file, checksums.txt, and checksums.txt.minisig from the download page. Every archive and the checksum manifest has its own sibling signature. Download the canonical Rilbo Minisign public key into the same directory:

curl -fLO https://rilbo.com/minisign.pub

In native Windows PowerShell, the equivalent download command is:

Invoke-WebRequest https://rilbo.com/minisign.pub -OutFile minisign.pub

Verify the manifest's signature before trusting any checksum in it. To check the complete manifest, download every archive listed in checksums.txt, then run:

minisign -Vm checksums.txt -p minisign.pub
sha256sum --check checksums.txt

sha256sum is available on Linux and in Windows Subsystem for Linux. On macOS, the equivalent built-in command is:

shasum -a 256 --check checksums.txt

In native Windows PowerShell, check every entry with:

Get-Content checksums.txt | ForEach-Object {
  $expected, $file = $_ -split '\s+', 2
  $file = $file.TrimStart('*')
  $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $file).Hash.ToLowerInvariant()
  if ($actual -ne $expected) { throw "Checksum mismatch: $file" }
}

You can also verify an archive directly against its sibling signature. Substitute the filename you downloaded when it differs from this example:

minisign -Vm rilbo-linux-x86_64.tar.zst -p minisign.pub

The downloaded key must contain exactly these two lines:

untrusted comment: minisign public key AEC3333E8779316B
RWRrMXmHPjPDrlz7OBdutuKwCEVX0j6T0cbmY/epbhHETxpWo2w1o3Db

If a release does not include the sibling .minisig files, it cannot be verified with this procedure; do not treat the absence of a signature as a successful check.

Docker

The container image ships the same binary on a minimal base:

docker run -d --name rilbo \
  -p 127.0.0.1:7373:7373 \
  -v rilbo-data:/data \
  -e RILBO_DB=/data/rilbo.db \
  ghcr.io/rilbo-com/rilbo:latest

Your data lives in the rilbo-data volume — one file to back up.

systemd (shared server)

For a self-hosted team server, run Rilbo as a system service with a hardened unit file:

[Service]
User=rilbo
StateDirectory=rilbo
Environment=RILBO_DB=/var/lib/rilbo/rilbo.db
Environment=RILBO_BIND=127.0.0.1:7373
ExecStart=/usr/local/bin/rilbo serve
Restart=on-failure

# Hardening — Rilbo only needs its state directory.
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true
ReadWritePaths=/var/lib/rilbo

sudo useradd --system --home /var/lib/rilbo rilbo
sudo install -m755 rilbo /usr/local/bin/rilbo
sudo install -m644 rilbo.service /etc/systemd/system/rilbo.service
sudo systemctl enable --now rilbo

Rilbo binds to localhost by default; terminate TLS at a reverse proxy (nginx/Caddy) in front of it. When you do, set RILBO_BASE_URL to the https:// public origin and RILBO_TRUSTED_PROXY=1 — the first is what marks session cookies Secure, the second what keeps login throttling per-client. Multi-user access (seats, roles) needs a Team licence; switch on password or token auth in configuration. Before you invite anyone, read security & access: the workspace is a single trust boundary, so everyone in it can read and write all of its data.

Upgrades & backups

Upgrades are: replace the binary, restart. Migrations run automatically and the schema version is checked at startup.

rilbo backup           # timestamped, checksummed snapshot
rilbo export           # portable compressed JSON (secrets omitted)
rilbo doctor           # integrity checks; non-zero exit when unhealthy

Automatic backups are on by default — see configuration.