# Your server

> Create a server at Hetzner or bring any Debian 13 server, install it with one command, and keep it up to date.

sitesolide runs on one Debian 13 server you own. `sitesolide machine` orders one at Hetzner, and `sitesolide setup` installs any.

## Create a server at Hetzner

In the [Hetzner console](https://console.hetzner.com/), create a project for sitesolide alone, since a token reaches everything in its project. Under **Security**, **API tokens**, generate a token with **Read & Write**.

The CLI reads the token from `HCLOUD_TOKEN`, never from an option:

```bash
read -rs HCLOUD_TOKEN && export HCLOUD_TOKEN
```

```bash
sitesolide machine create --provider hetzner --name web
```

It uploads your public key, creates a firewall that opens 22, 80 and 443, and orders a Debian 13 `cx23` (2 vCPU, 4 GB). `--type` and `--location` change the defaults, and `--backups` turns on Hetzner's daily backups.

To list the servers sitesolide created, with their addresses and monthly price before VAT:

```bash
sitesolide machine list --provider hetzner
```

To delete one with its disk, its Hetzner backups and its firewall, type its name back when asked:

```bash
sitesolide machine destroy web --provider hetzner
```

Its DNS records stay in your zone: delete them yourself.

## Bring your own server

Any fresh Debian 13 server works, from any provider, reachable as `root` with your SSH key. Setup refuses another system unless `--any-os` says to go on at your own risk.

## Run setup

```bash
read -rs CLOUDFLARE_API_TOKEN && export CLOUDFLARE_API_TOKEN
```

```bash
sitesolide setup root@203.0.113.10 --zone example.com --email you@example.com
```

Setup prints a checklist as it goes. It:

- creates a `deploy` account with sudo, then closes SSH to root and to passwords;
- turns on the ufw firewall, fail2ban and daily security updates;
- creates the DNS records of the zone and its wildcard on Cloudflare;
- installs Caddy with its Cloudflare DNS module, Bun, and the platform: the dashboard, the sign-in portal, the monitor and backups;
- writes `~/.config/sitesolide/config.json`, which every other command reads.

It shows the dashboard's and the portal's passwords once: store them. `--dry-run` checks every step and changes nothing. `--minimal` leaves out backups, the egress proxy, and the installer that deploys with a token.

## Run setup again

Run the same command at any time. On an installed server it changes nothing, and after a failure it resumes at the failed step. Without `--minimal`, it adds what a minimal run left out.

## Use another DNS provider

`--skip-dns` leaves Cloudflare alone: setup prints the records to create and waits for them to resolve. Caddy still needs your provider's DNS module for the wildcard certificate, which takes a checkout of the repository: see [Another DNS provider](https://github.com/cthiriet/sitesolide/blob/main/docs/install.md#another-dns-provider).

## Reboot for kernel updates

Security updates install every day, but nothing reboots the server: a new kernel waits for you. When `/run/reboot-required` exists, check what asked for it:

```bash
ssh deploy@203.0.113.10 'cat /run/reboot-required.pkgs 2>/dev/null; uname -r'
```

Then reboot at a quiet hour, since every site stops while the server boots:

```bash
ssh deploy@203.0.113.10 'sudo systemctl reboot'
```

Caddy, the platform and every project's services start again on their own. To reboot unattended at a fixed hour, see [Updates and reboots](https://github.com/cthiriet/sitesolide/blob/main/docs/concepts.md#updates-and-reboots).

## Next steps

- [Deploy a project](deploy.md): put your first project on the server.
- [Monitoring](monitoring.md): hear when the server itself goes down.
- [Backups and restore](backups.md): copy the snapshots off the server.
- [Upgrading](upgrading.md): bring the server to a new release.

Full reference: https://github.com/cthiriet/sitesolide/blob/main/docs/setup.md