One host, the package's own unit, nothing external. This is the shape Choose your deployment points at for a systemd host running everything in one process.

1. Prerequisites

A Debian, Ubuntu, Fedora or RHEL host with systemd and root access. Nothing else: the package brings the binary, the system user and the state directory.

2. Install

curl -fsSL https://pkgs.jaque.sh/install.sh | sh

See Install for the apt/dnf repositories by hand, archive verification, and the signing key's fingerprint.

3. The files

The package already installs /etc/default/jaque with these values; the canonical copy is deploy/systemd/single/jaque.env in the repository, and nothing else needs writing for a single node -- the packaged jaque.service unit is enough as it ships.

# /etc/default/jaque
JAQUE_CONFIG=/etc/jaque/config.cue
JAQUE_EVENTLOG=file:///var/lib/jaque/eventlog
JAQUE_LISTEN=127.0.0.1:8080

Edit /etc/jaque/config.cue with your own hosts and checks before starting; the package installs a one-host self-check there as a placeholder.

4. Start

systemctl enable --now jaque

5. Verify

jaque version
curl http://127.0.0.1:8080/status.json

The dashboard is at http://127.0.0.1:8080/ -- reachable from the host itself, since JAQUE_LISTEN is loopback by default; put a reverse proxy in front to reach it from elsewhere.

6. Where things live

Config at /etc/jaque/config.cue, environment at /etc/default/jaque, state (the event log) under /var/lib/jaque. Logs go to the unit's journal: journalctl -u jaque.

7. Upgrade

apt-get update && apt-get install -y jaque   # Debian/Ubuntu
dnf upgrade -y jaque                          # Fedora/RHEL

The package upgrade restarts the unit; the event log on disk survives it.

8. Next steps

CUE in practice adds services and contacts to the placeholder config. Contacts and policies wires a hard state to a person. Metrics is what /metrics on this same port exposes, and the dashboard it describes at the bottom of that page.

9. Security considerations

JAQUE_LISTEN=127.0.0.1:8080 is loopback by default; see Security before binding it anywhere else. The unit runs as the unprivileged jaque user with ProtectSystem=strict and the other hardening in the packaged jaque.service.