Server Setup

Requirements

• A server with a public IP
• A domain pointing to that IP (A record)
• Port 443 open (or a custom port)

Initialize

atomic init --domain agent.yourcompany.com

This does everything:

1. Generates an Ed25519 keypair
2. Writes credentials to ~/.atomic/credentials
3. Creates agent.json
4. Obtains a TLS certificate via Let’s Encrypt
5. Starts the server as a background daemon

Verify

curl -s https://agent.yourcompany.com/.well-known/agent.json | jq .

Running behind a proxy

If you’re behind nginx or a load balancer:

atomic init --domain agent.yourcompany.com --proxy

The --proxy flag tells Atomic to trust X-Forwarded-For headers for IP-based rate limiting.

Custom TLS

Bring your own certificate:

atomic init --domain agent.yourcompany.com \
  --tls-cert /path/to/cert.pem \
  --tls-key /path/to/key.pem

No TLS

For development or when TLS is terminated elsewhere:

atomic init --domain localhost --no-tls --port 8080

Data directory

Everything lives in ~/.atomic/:

~/.atomic/
├── credentials       # domain, private key, public key
├── agent.json        # served at /.well-known/agent.json
├── atomic.db         # SQLite (deposits, magic links)
└── tls/
    ├── cert.pem
    └── key.pem