Your server

sitesolide runs on one Debian 13 server you own. sitesolide machine orders one at Hetzner, and sitesolide setup installs any.

In the Hetzner console, create a project for sitesolide alone, since a token reaches everything in its project. Under Security, API tokens, generate a token with Read & Write.

The CLI reads the token from HCLOUD_TOKEN, never from an option:

$ read -rs HCLOUD_TOKEN && export HCLOUD_TOKEN

$ sitesolide machine create --provider hetzner --name web

It uploads your public key, creates a firewall that opens 22, 80 and 443, and orders a Debian 13 cx23 (2 vCPU, 4 GB). --type and --location change the defaults, and --backups turns on Hetzner's daily backups.

To list the servers sitesolide created, with their addresses and monthly price before VAT:

$ sitesolide machine list --provider hetzner

To delete one with its disk, its Hetzner backups and its firewall, type its name back when asked:

$ sitesolide machine destroy web --provider hetzner

Its DNS records stay in your zone: delete them yourself.

Any fresh Debian 13 server works, from any provider, reachable as root with your SSH key. Setup refuses another system unless --any-os says to go on at your own risk.

$ read -rs CLOUDFLARE_API_TOKEN && export CLOUDFLARE_API_TOKEN

$ sitesolide setup root@203.0.113.10 --zone example.com --email you@example.com

Setup prints a checklist as it goes. It:

• creates a deploy account with sudo, then closes SSH to root and to passwords;
• turns on the ufw firewall, fail2ban and daily security updates;
• creates the DNS records of the zone and its wildcard on Cloudflare;
• installs Caddy with its Cloudflare DNS module, Bun, and the platform: the dashboard, the sign-in portal, the monitor and backups;
• writes ~/.config/sitesolide/config.json, which every other command reads.

It shows the dashboard's and the portal's passwords once: store them. --dry-run checks every step and changes nothing. --minimal leaves out backups, the egress proxy, and the installer that deploys with a token.

Run the same command at any time. On an installed server it changes nothing, and after a failure it resumes at the failed step. Without --minimal, it adds what a minimal run left out.

--skip-dns leaves Cloudflare alone: setup prints the records to create and waits for them to resolve. Caddy still needs your provider's DNS module for the wildcard certificate, which takes a checkout of the repository: see Another DNS provider.

Security updates install every day, but nothing reboots the server: a new kernel waits for you. When /run/reboot-required exists, check what asked for it:

$ ssh deploy@203.0.113.10 'cat /run/reboot-required.pkgs 2>/dev/null; uname -r'

Then reboot at a quiet hour, since every site stops while the server boots:

$ ssh deploy@203.0.113.10 'sudo systemctl reboot'

Caddy, the platform and every project's services start again on their own. To reboot unattended at a fixed hour, see Updates and reboots.

• Deploy a project: put your first project on the server.
• Monitoring: hear when the server itself goes down.
• Backups and restore: copy the snapshots off the server.
• Upgrading: bring the server to a new release.