Install PocketBase on your VPS
Infraa installs PocketBase on your VPS as a single Go binary — an embedded SQLite database, built-in user authentication, file storage, a realtime API, and an admin dashboard in one file. The binary is pinned and verified against a checked-in SHA-256, runs as a dedicated non-root system user, and binds to localhost on the port you choose.
- Versions
- PocketBase 0.39.5, a pinned single-binary release verified by SHA-256
- Works on
- Ubuntu 22.04, Ubuntu 24.04, and Debian 12
- Package source
- Pinned binary release
What does the PocketBase install do?
- Creates a dedicated, non-login system user (infraa-pocketbase) — PocketBase never runs as root.
- Downloads the pinned PocketBase binary into /opt/infraa/apps/pocketbase, verifying it against a SHA-256 checksum that ships in the reviewed catalog before it's moved into place.
- Installs a systemd unit (infraa-pocketbase.service) that runs pocketbase serve bound to 127.0.0.1 on your chosen port, with data in /var/lib/infraa-pocketbase/pb_data.
- Enables and starts the service, then verifies it's listening.
How do I install PocketBase with Infraa?
Connect your server
Run the Infraa install one-liner (curl install.infraa.sh | sh) on your VPS. The agent registers over an outbound connection in about 30 seconds — no inbound ports, no SSH keys to share.
Pick the service
Choose it from the one-click catalog in the dashboard, or just ask in chat. Infraa turns your request into a concrete, reviewable plan.
Review and approve
Read exactly what will run, then approve. The agent executes only the approved, cryptographically signed steps and streams progress live.
What happens after the install?
Infraa checks PocketBase every 60 seconds — the service unit and your chosen port. The admin UI lives at /_/; since the install is localhost-only, reach it over an SSH tunnel first and create your admin account. To put it on the internet, install the nginx module and point a managed vhost with Let's Encrypt at the port — the public surface stays managed like every other proxied service.
PocketBase on Infraa — common questions
01Is PocketBase exposed to the internet after the install?
No. The systemd unit binds PocketBase to 127.0.0.1 on the port you choose (8090 by default), so only processes on the server can reach it. To expose it publicly with a domain and TLS, install the nginx module and point a managed reverse-proxy vhost with Let's Encrypt at that port.
02Where does my PocketBase data live?
In /var/lib/infraa-pocketbase/pb_data. It survives restarts and re-installs — a re-install upgrades the binary without touching data — and uninstalling removes the service but leaves your data and the binary in place, so reinstalling later resumes from the same data.
03How does Infraa verify the PocketBase binary?
The version, download URL, and SHA-256 checksum are pinned in the reviewed module catalog — they're code-reviewed data, not fetched at install time. The agent verifies the checksum before the binary is moved into place, and version bumps are a catalog change: re-running the install fetches the new binary and restarts the service.
Connect a server in 30 seconds, then install PocketBase from the catalog or just ask in chat.
