First setup

The setup token

The installer's last lines are the panel URL (https://<your-server-ip>:7443) and a one-time setup token. The token is printed on the console and nowhere else. There is no default password, because no account exists yet.

Open the URL and accept the certificate warning. The certificate is self-signed until the panel has a hostname.

Step 1 of 5 asks for the setup token, your name, your email and a password of at least twelve characters, twice. Once that administrator exists, the setup endpoint stops answering.

Passwords are hashed with argon2id. Sessions are server-side, SameSite=Strict, and rotated on sign-in. Add a second factor from the account page: TOTP with recovery codes.

Activating a licence

A server with no key already runs the Free edition: one server, five sites, everything except cPanel and DirectAdmin migration, staging and resellers. A Free key from my.klyrn.com registers the server on your account there, with its version and health. A paid licence such as Pro is activated there. Activate from Settings in the panel, or from a shell:

klyrn license activate <key>
klyrn license status
klyrn license refresh       # fetch a freshly signed entitlement
klyrn license deactivate    # release the activation for another server

The entitlement is signed and cached on the server. If licensing is unreachable, the sites this server hosts keep serving.

Giving the panel a hostname

Point a name at the server (panel.example.com), then tell KLYRN about it. The panel requests a Let's Encrypt certificate for that name and starts presenting it, which ends the browser warning.

klyrn panel                              # URL, hostname and certificate state
klyrn panel hostname panel.example.com   # request a certificate and use it
klyrn panel hostname none                # go back to the self-signed certificate

The panel stays on port 7443 either way. The nginx that serves customer sites does not serve the panel, and the two never share a listener.

The backup destination

Local backups work immediately and are stored root-only under /var/lib/klyrn/backups/. They do not survive the disk. Before you put anything real on the server, add an S3-compatible destination. Record the encryption key somewhere off this machine.

klyrn backup key list      # version, fingerprint, created, which one writes
klyrn backup key export    # the current key, in full. Store this off the server

Copies are encrypted on the server before they leave it, so the bucket operator never holds plaintext. Losing the key means losing the copies: nothing on the server can recover it. Backups and Disaster recovery cover the rest.

Checking the server

klyrn status           # services, versions, resource use
klyrn health           # every check and its last result
klyrn health --events  # repairs the health engine attempted, and why
klyrn profile          # the hardware profile and every tuned value with its reason

Read klyrn profile once. It lists every nginx, PHP-FPM and MariaDB value KLYRN set, with the rule that produced it.