Installing a worker
What a worker is, what it costs to run, and the four questions the installer asks.
A worker is a small agent you run on a machine you already have. It measures the reachability and round-trip time of addresses the platform gives it, signs the results, and uploads them. It does not serve traffic, it does not listen on any port, and it does not hold a copy of anything about the provider it is measuring.
What it costs to run
Less than most people expect, which is the first question every prospective operator asks.
| Resource | Cost |
|---|---|
| Memory | A few MB. No routing data is held, only a small signed target list. |
| CPU | Negligible. Sending pings and signing small batches; idle otherwise. |
| Bandwidth | A trickle. A few ICMP packets per minute per target, plus a heartbeat about every thirty seconds. |
| Disk | Tens of MB: the image, the current snapshot, and a bounded upload queue. |
| Inbound ports | None. Outbound HTTPS on 443 only. |
The requirements the installer checks are a separate list, and a larger one: they are the floor to start, not the cost to run. See Worker requirements.
Installing
The installer is a shell script fetched from the project's own repository and piped into a shell. That is a pattern worth being suspicious of in general, so: the script is published from release tooling, it is versioned, and you can read it before you run it. Doing that is encouraged.
curl -fsSL https://raw.githubusercontent.com/HummingByteDev/vpsa-network-discovery/main/deploy/worker/install.sh -o install.sh
less install.sh
sh install.shThe script installs the vapn command and then runs vapn install, which
is interactive and asks four questions: a name for the worker, the enrollment token, the region it
is in, and whether to enable automatic updates.
The four questions
A name
Lowercase letters, digits and dashes, between three and forty characters. The name appears in
your own vapn status output and in the fleet register, so pick something that will
still mean something to you in six months. A name with a space or a slash in it is a paste that
breaks later, which is why the rule is narrow.
An enrollment token
Issued when your worker request is approved, and shown exactly once, to the person who created it. It is not recoverable: if you lose it, ask for a new one rather than hunting for the old one.
A region
Where the machine actually is, not where you would like it to be. The whole value of the network is that measurements come from many real places, and a worker filed under the wrong region makes a provider's regional breakdown wrong for everybody reading it.
Automatic updates
Off by default, and opt-in. The worker does not upgrade itself unless you say so. This is worth stating plainly because it is the one thing about the install that is commonly assumed the other way round: if you leave it off, you are responsible for keeping the worker inside the supported version window.
After the install
Run vapn status. A healthy worker reports that it is enrolled, that it has a
current target snapshot, and when it last uploaded. If it does not, start with
Worker installation problems.
A newly enrolled worker does not start contributing to any provider's verdict immediately. It has to establish a record first, which is covered in How workers contribute to monitoring.
Was this page helpful?