First setup

The setup token

The installer's last lines are the panel URL (https://<your-server-ip>:7443) and a one-time setup token. The token is printed on the console and nowhere else. It is not a default password: there is no account yet for it to belong to.

Open the URL and accept the certificate warning. The panel is on its own TLS listener with a self-signed certificate until it has a hostname, so the warning is expected at this point and only at this point.

Step 1 of 5 asks for the setup token, your name, your email and a password of at least twelve characters, twice. The moment that administrator exists, the setup endpoint stops answering: there is no window in which a second person can use the same token.

Passwords are hashed with argon2id. Sessions are server-side, SameSite=Strict, and rotated on sign-in. Add a second factor from the account page as soon as the account exists: TOTP with recovery codes.

Activating a licence

A server with no key is already running the Free edition: one server, five sites, everything except reseller accounts. A Free key from my.klyrn.com registers the server on your account there, with its version and health, and is where a paid licence is activated once the paid editions are on sale. Activate from Settings in the panel, or from a shell:

klyrn license activate <key>
klyrn license status
klyrn license refresh       # fetch a freshly signed entitlement
klyrn license deactivate    # release the activation for another server

The entitlement is signed and cached on the server. If licensing is unreachable, the sites this server hosts keep serving; that is deliberate and is the first thing we test after a deploy.

Giving the panel a hostname

Point a name at the server (panel.example.com), then tell KLYRN about it. The panel requests a Let's Encrypt certificate for that name and starts presenting it, so the browser warning goes away for good.

klyrn panel                              # URL, hostname and certificate state
klyrn panel hostname panel.example.com   # request a certificate and use it
klyrn panel hostname none                # go back to the self-signed certificate

The panel stays on port 7443 either way. It is not served through the same nginx that serves customer sites, and it never shares a listener with them.

The backup destination

Local backups work immediately and are stored root-only under /var/lib/klyrn/backups/. They do not survive the disk. Before you put anything real on the server, add an S3-compatible destination and record the encryption key somewhere that is not this machine.

klyrn backup key list      # version, fingerprint, created, which one writes
klyrn backup key export    # the current key, in full. Store this off the server

Copies are encrypted on the server before they leave it, so the bucket operator never holds plaintext. Losing the key means losing the copies: nothing on the server can recover it for you. Backups and Disaster recovery cover the rest.

Checking the server

Four commands say everything about the state of a fresh install.

klyrn status           # services, versions, resource use
klyrn health           # every check and its last result
klyrn health --events  # repairs the health engine attempted, and why
klyrn profile          # the hardware profile and every tuned value with its reason

klyrn profile is worth reading once. Every nginx, PHP-FPM and MariaDB value KLYRN set is listed with the rule that produced it, so a number you disagree with is at least a number you can argue with.