Installation

One command coming soon

A one-command installer is being prepared. It will:

1. Check the server: OS, RAM, disk, free ports 80 and 443, time, DNS of the domain and the admin. subdomain.
2. Activate the license by key and domain.
3. Prepare the server: Docker, firewall (SSH, 80, 443), fail2ban, automatic security updates.
4. Create the installation folder and the .env settings file with random passwords (mode 600).
5. Download signed images, apply database migrations and start the services.
6. Close the admin panel to everyone except the address the installer was run from.
7. Create the owner with 2FA and print a summary: site and admin URLs, owner password, where to save the backup password.

Re-running it continues the installation instead of breaking it. The command will appear here and in the buyer account when the installer ships — until then, install step by step.

Step by step

Until the installer is ready, the engine is installed from a release archive provided by the OneSwaper team. The scripts are in the archive under infra/server/ and are run in order.

1. Prepare the server

As root on a clean server. The script stops an old web server and database if present (does not remove them) and adds 2 GB of swap:

bash infra/server/00-prepare.sh

Inspect the system, ports and services — changes nothing:

bash infra/server/01-inspect.sh

2. Harden the server

As root. Creates the deploy user with your SSH keys, enables key-only SSH, firewall (SSH, 80, 443), automatic security updates, fail2ban and installs Docker. Removes nothing.

bash infra/server/02-harden.sh

Check your login first

Open a new terminal window and log in as deploy. Only when that works, close root login:

bash infra/server/03-close-root.sh

3. Point the domain to the server

DNS A records for the domain and admin. pointing to the server IP (see Requirements). If the domain is behind Cloudflare, set it up as described here first, otherwise Caddy cannot get a certificate.

4. Start the engine

As deploy, from the installation folder (where the release archive was unpacked), with your domain:

bash infra/server/04-deploy.sh example.com

The script:

• creates .env with random passwords for the database and sessions, the secrets encryption key, the backup password and the admin gate secret;
• sets the admin URL to admin.example.com and closes it to everyone (ADMIN_ALLOWED_IPS=127.0.0.1/32);
• starts the database, validates the Caddy config, applies migrations and switches the app to a database role that cannot alter logs;
• starts the API, worker and Caddy and prints the site and admin URLs and the command to create the owner.

The first run takes a few minutes while images are built.

5. Open the admin panel for yourself

Find your IP and put it into .env in the installation folder:

ADMIN_ALLOWED_IPS=203.0.113.10/32

Several addresses or subnets — space-separated. Restart Caddy:

docker compose up -d caddy

Operator addresses are added later in the admin panel itself — no server changes needed (see Server security).

6. Create the owner

Run the owner creation command printed at the end of 04-deploy.sh, with your email. It shows the password and the link for an authenticator app once. Save the password in a password manager and add the code to the app.

7. Check

curl -s https://example.com/api/health

The answer {"ok":true,"version":"…","status":"ok"} means the engine is running. Open https://admin.example.com/admin/login, sign in and continue with the first run.

Save the backup password

Without it a backup cannot be opened. To view it: grep ^BACKUP_PASSWORD= .env in the installation folder. Put it into your password manager right away.