Install Protect Agent

Protect Agent complements external domain checks with the actual state of the equipment. The Protect Home profile is designed for NAS devices and Raspberry Pi systems; Protect Server describes use on a Linux VPS. Both profiles share the same Docker installation and secure protocol.

Choose the right profile

Protect Home: native package for Synology DSM 7

The beta Protect Home 0.5.1-1 package targets rtd1296 ARM64 Synology models, including the DS118 and DS218 running DSM 7.

Download Protect Home for DSM 7

SHA-256: 5c004d16ab55d0bff6697ba6c32af05970e4d7152e36843565f9158ec3323223

1. Open Package Center → Manual Install.
2. Select ProtectHome-rtd1296-0.5.1-1.spk.
3. Accept the third-party publisher warning, then start the package.
4. Open Protect Home from DSM and check its status.

Protect Home or Server: install with Docker

Before you start

• Docker is available on the device;
• the TechAtelier Protect app is installed and signed in;
• the device can reach https://infra.techatelier.fr ;
• the terminal and your iPhone are available for a few minutes.

The installation program automatically checks Docker Compose. On a NAS without Docker, see the dedicated solution below.

1. Download and check the installation program

From the terminal of the Linux machine you want to monitor:

curl -fsSLo install-protect-home.sh https://techatelier.fr/install-protect-home.sh
less install-protect-home.sh
sh install-protect-home.sh

less lets you read the script before it is executed; press q to return to the terminal. The program requests the name of the equipment, downloads agent 0.20 and prepares its secure storage.

If you prefer a direct order:

curl -fsSL https://techatelier.fr/install-protect-home.sh | sh

2. Scan the QR in the application

The terminal displays a QR code and manual code valid for ten minutes, then stays on "Awaiting validation...".

1. In the application, open Protect Home then Add.
2. Touch Scan QR code, or enter the manual code.
3. Check the name and architecture presented.
4. Touch Associate this equipment.

The camera closes as soon as the QR is recognized. After confirmation, the terminal records the identifiers in the private volume and automatically starts the permanent monitoring.

3. Check first measure

The program displays the status of service at the end of the installation. Return to the app and update: the equipment changes from "First measurement on hold" to "Available" after the first heartbeat.

cd ~/techatelier-protect-home
docker compose ps
docker compose logs --tail=20 protect-home-agent

The agent then sends a measurement every five minutes and automatically restarts with Docker.

5. Add optional volumes

Protect does not browse any files. It only measures the overall percentage of explicitly mounted read-only storages.

# Dans compose.yaml, sous volumes:
- /:/volumes/systeme:ro
- /chemin/stable/du/stockage:/volumes/donnees:ro

# Dans .env
PROTECT_HOME_VOLUMES=systeme=/volumes/systeme,donnees=/volumes/donnees

The host path must be a truly active and stable mounting. Do not add an unavailable CIFS share or point autofs Unmounted: Docker could fail at startup or measure the empty local folder. Never use a writing mount.

6. Report successful backup

Your backup tool can update a cookie file only after successful execution. Mount this file as a read-only file and indicate its path to the container.

# compose.yaml
- /chemin/backup-success:/markers/backup-success:ro

# .env
PROTECT_HOME_BACKUP_MARKER=/markers/backup-success

Protect measures the age of the witness; it does not trigger or modify the backup.

Manual installation and advanced configuration

Use this method only if you want to control the Compose file yourself. The example maintained with agent is found in protect-home-agent/compose.example.yaml.

mkdir -p ~/techatelier-protect-home
cd ~/techatelier-protect-home
curl -fsSLo compose.yaml https://raw.githubusercontent.com/yanrem/TechAtelier-Platform/main/protect-home-agent/compose.example.yaml
docker compose pull
docker compose run --rm protect-home-agent --enroll --name "Primary machine"
docker compose up -d

Keep the volume agent_state It contains the identifiers created during the association.

Machine without Docker

The beta version of the agent is distributed as a container. If the machine you want to monitor cannot run Docker, install the agent on another compatible Linux machine on the same network and mount the required resources read-only there. The application remains generic: only locally configured paths in Compose change.

Quick troubleshooting

• The QR is not recognized: use the manual code displayed just above;
• The camera closes: This is normal after a successful reading; then check the association form;
• Authentication required: Reconnect in the application and generate a new code;
• pending validation: check that you have touched "Associate this equipment";
• First action pending: Launch docker compose up -d then check the logs;
• Reboot container: check that the volume agent_state containing identifiers is well used;
• no volume: control the installation in read only and PROTECT_HOME_VOLUMES ;
• temperature absent: Some machines or containers do not expose it, it is not blocking.

Update agent

When the app says a new version is available, download and then check the update program:

curl -fsSLo update-protect-home.sh https://techatelier.fr/update-protect-home.sh
less update-protect-home.sh
sh update-protect-home.sh

The program saves the Compose file, only replaces the official image, validates the configuration and restarts the agent. Volume agent_state is not changed: the association and identifiers are kept.

For a facility located elsewhere, specify its folder:

PROTECT_HOME_INSTALL_DIR=/chemin/de/installation sh update-protect-home.sh

Uninstall

First revoke the equipment in Protect, then launch docker compose down From his file. Add --volumes Only if you also want to delete the identifiers and local sequence.

Published on August 13, 2026 · updated on August 30, 2026.