Deployment guide

This guide walks through a standard single-node deployment: base packages, container runtime, TLS certificates and service hardening. Follow the sections in order — later steps assume the earlier ones completed without errors.

Requirements

• Debian 11/12 or Ubuntu 20.04 and newer, root access;
• a public IPv4 address and two A-records pointing at the node;
• inbound TCP/80 and TCP/443 plus UDP/443 open before first start;
• at least 1 GB RAM and 3 GB of free disk space.

Prepare the host

Update the package index, then install the base utilities used by the remaining steps.

apt-get update && apt-get upgrade -y
apt-get install -y curl ca-certificates dnsutils jq cron openssl

Issue certificates

Certificates are renewed automatically. The pre-hook releases the HTTP port so the challenge can be answered, and the post-hook restores the service afterwards.

acme.sh --issue --standalone -d node.example.com \
  --pre-hook  "systemctl stop edge" \
  --post-hook "systemctl start edge"

Verify the deployment

Confirm that the listeners are bound, then check the effective TLS configuration.

ss -lntup | grep -E ':443|:80'
openssl s_client -connect 127.0.0.1:443 -servername node.example.com -brief </dev/null

If a listener is missing, inspect the service log before changing any configuration files.

Next steps

• configure the firewall to allow the panel address only;
• enable log rotation for the container runtime;
• schedule a monthly upgrade window.