> ## Documentation Index
> Fetch the complete documentation index at: https://frp.xdr.ooo/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Client

> Enroll and verify a Linux/systemd client using the current stable workflow.

# Linux Client

Linux/systemd is the current stable client scope for FRP Auto Deploy.

## What the client needs

Before enrollment, confirm:

* `sudo`/root access is available for installation
* the client can make outbound connections to the FRP server public endpoints
* any service you want to publish already exists and is reachable from the client
* for SSH, the SSH user already exists and `sshd` is running

FRP Auto Deploy does not create operating-system users, passwords, SSH keys, or application services.

## Choose enrollment method

| Method                     | Best when                                            | Who chooses initial services? |
| -------------------------- | ---------------------------------------------------- | ----------------------------- |
| **Zero-Touch**             | server admin wants a ready-to-run command            | server admin                  |
| **Manual Enrollment Code** | remote operator should choose services interactively | remote operator               |

```mermaid theme={null}
flowchart TD
    A[Need to enroll a client] --> B{Should the server admin\npredefine the initial profile?}
    B -->|Yes| Z[Zero-Touch]
    B -->|No| M[Manual Enrollment Code]
    Z --> R[Run generated command once]
    M --> R
    R --> V[Verify client + server state]
```

## Recommended: Zero-Touch

For the easiest interactive server workflow:

```bash theme={null}
sudo frpctl
```

Then:

```text theme={null}
create zero-touch
```

For an explicit SSH profile:

```bash theme={null}
sudo frpctl create enrollment \
  --one-line \
  --ssh \
  --ssh-user aella \
  --label branch-a
```

Replace `aella` with an SSH account that already exists on the target machine. Run the **exact generated command** on the client; do not reconstruct the bootstrap payload manually.

## Manual Enrollment Code

On the server:

```bash theme={null}
sudo frpctl create enrollment
```

Run the generated client bootstrap command and enter the short-lived Enrollment Code when prompted. The installer can then guide the remote operator through service selection.

## What happens during enrollment

```mermaid theme={null}
sequenceDiagram
    participant C as Linux client
    participant S as FRP Auto Deploy server

    C->>S: bootstrap credential over HTTPS
    C->>C: verify server trust / CA path
    C->>S: enrollment
    S-->>C: CLIENT identity + service config
    C->>S: start outbound FRP control tunnel
```

## Verify on the client

```bash theme={null}
sudo frpctl show version
sudo frpctl show status
sudo frpctl show services
sudo frpctl show info
sudo frpctl doctor
```

## Verify on the server

```bash theme={null}
sudo frpctl show clients
sudo frpctl show enrollments
sudo frpctl show client <CLIENT-ID>
sudo frpctl show client <CLIENT-ID> services
```

The client receives a persistent CLIENT ID. Normal reboots, supported service edits, and normal stable project updates do not require a new enrollment.

## Changing services later

Client-side service edits are staged:

```text theme={null}
add service
set service <service-id> target-host <host>
set service <service-id> target-port <port>
apply
```

Use `discard` before `apply` if you want to throw away pending changes.

## Important lifecycle rule

```text theme={null}
client uninstall != server release
```

Removing local client software does not automatically free the server's public-port reservations. See [Lifecycle Semantics](/operations/lifecycle).