Connecting an executor takes two actions that have to happen in order: the control plane issues an API key tied to your organization, and you install the executor binary (Agent) or chart (Operator) on your infrastructure pointing at that key.Documentation Index
Fetch the complete documentation index at: https://docs.novacula.io/llms.txt
Use this file to discover all available pages before exploring further.
Prerequisites
- A role that can create API keys: owner or admin. See Roles and permissions.
- One of:
- A Linux host (Ubuntu 22.04+, Debian 12+) with
sudofor the Agent. - A Kubernetes cluster (1.27+) with cluster-admin for the Operator.
- A Linux host (Ubuntu 22.04+, Debian 12+) with
- Outbound HTTPS to the control plane URL. No inbound connectivity is required.
Steps
Open the connect dialog
From the sidebar: Executors → Connect new executor. Pick a backend:
agent— bare-metal daemon, manages nodes assystemdservices.operator— Kubernetes controller, manages nodes asBlockchainNodeCRs.
stable, beta). Channel controls which executor releases the control plane offers as upgrades.Copy the API key
Submit the form. The next screen shows:
- The full API key string.
- A copy-pasteable install command for your chosen backend.
Install on your infrastructure
Run the install command on the target machine.
- Agent — see Provision on bare-metal for the full TOML config and
systemdsetup. - Operator — see Provision on Kubernetes for the Helm install and CRD bootstrap.
- Reads the API key from local config.
- Calls
syncExecutoragainst the control plane URL. - The control plane creates the
Executorrow keyed by(organizationId, name). - The executor declares its capabilities — chains, networks, clients, versions.
Confirm online
Back in the UI, the executor row should flip to
online within a few seconds (heartbeat is 5s; offline timeout is 30s). The capabilities list should populate with the chains the binary was built with.If the row stays offline:- Check the executor’s logs (
journalctl -u novacula-agentorkubectl logs -n novacula-system deploy/operator). - Confirm outbound HTTPS to the control plane URL.
- Verify the API key was copied without trailing whitespace.
What happens server-side
- An
ApiKeyrow is created with the org id stored in metadata. - On first
syncExecutor, anExecutorrow is created (if(orgId, name)is new) or upserted (if you’re reconnecting an existing executor against a fresh key). - An
executor.connectedevent is written to the Events feed. - An
ExecutorApiKeyUsagerow tracks which key was used, for the API-key list’s “last used” column.
Reconnecting an existing executor
If you’ve reinstalled or moved an executor and it comes back online with the same name + org, it picks up where it left off — theExecutor row is reused. To force a fresh row, change the name in the agent’s TOML or the operator’s NOVACULA_OPERATOR_NAME.
Next steps
- Deploy a node onto your fresh executor.
- Roles and permissions — invite teammates with the right access level.
- Rotate executor API keys — zero-downtime key rotation.