Install a server

From a bare Enterprise Linux 10 machine (Rocky, Alma or RHEL 10) to a running Elpan server. The installer, install.sh, does most of it; three things have to be in place before you run it: the hostname, the network addresses, and the quota options on the root filesystem.

The installer refuses a host with less than 2.5 GiB of RAM as the kernel sees it (a 3 GB host). What a host of each size can run is in Sizing profiles.

Before the installer

Hostname

Elpan is initialized with the machine's fully qualified hostname, which the installer reads with hostname -f and asks you to confirm. Set it first:

hostnamectl set-hostname <server hostname>
hostname -f

The server's own services live under this name: the admin app at admin.<server hostname>, the account panel at control.<server hostname>, the mail servers and the name servers (dns1 and dns2).

Static addresses

The server needs its own address, and one more IPv4 address (and one IPv6 address, if you use IPv6) for each shared IP address group you want the installer to create. Each account belongs to one group, and its websites are served from the group's addresses. One group is enough to start; Shared IP Address Groups explains when you want more.

Set the addresses statically with NetworkManager, with a public resolver for now (the installer switches it later):

nmcli con mod <connection> \
  ipv4.method manual \
  ipv4.addresses <own address>/24,<group address>/24 \
  ipv4.gateway <gateway> \
  ipv6.method manual \
  ipv6.addresses <own address>/64,<group address>/64 \
  ipv6.gateway <gateway> \
  ipv4.dns 8.8.8.8 ipv4.ignore-auto-dns yes \
  ipv6.dns "" ipv6.ignore-auto-dns yes
nmcli con up <connection>

For an IPv4-only server, set ipv6.method disabled instead of the IPv6 lines. nmcli device lists the interfaces and their connection names, and nmtui is an interactive alternative.

Changing the address you are connected on

Run nmcli con up from the console, not over SSH, when it changes the address of your SSH session.

Quota options on the root filesystem

Account storage limits are filesystem quotas. The installer does not touch them, so set them before it runs. Add usrquota,grpquota,prjquota to the root filesystem's options in /etc/fstab, and to the kernel command line:

grubby --update-kernel=ALL --args="rootflags=prjquota,usrquota,grpquota"

The reboot the installer asks for later applies them.

Process privacy

So that an account's shell sees only its own processes, mount /proc with hidepid=2, in /etc/fstab:

proc  /proc  proc  defaults,hidepid=2,nosuid,nodev,noexec  0  0

Run the installer

As root, with the options you need:

curl -fsSL https://repo.rekalogika.com/install.sh | sudo bash -s -- \
  --ip-group <IPv4 address>,<IPv6 address> \
  --with-databases=mariadb-12,postgres-18,valkey-9

Option	What it does
`-y`, `--yes`	Don't ask for confirmation (the hostname question).
`--ip-group <addresses>`	Create a shared IP address group from these addresses, separated by commas. Repeatable, one group per occurrence.
`--with-databases=<engines>`	Install the database engines accounts can create databases on: `mariadb-12`, `postgres-18`, `valkey-9`, separated by commas. Default: none.
`--with-clamav`	Virus scanning of mail. Needs an 8 GB host; the installer refuses it on less. See Virus scanning.
`--profile <profile>`	The sizing profile: `auto` (default, from the RAM), `tiny`, `small`, `standard` or `large`. A profile you give is written to `/etc/elpan/sizing.conf`, so it holds whatever the RAM says later.
`--staging`	Use the certificate authority's test environment (the Let's Encrypt staging directory), for a test server.
`--acme <URL>`	The ACME directory URL of your own certificate authority, instead of Let's Encrypt. See Your own certificate authority.
`--no-devtools`	Skip the development toolchains (Node.js, Python, Ruby, Perl, Go, Rust, Java, .NET, Composer, WP-CLI).
`--no-brew`	Skip the Homebrew installation.
`--reboot`	Reboot by itself when the kernel command line changed, instead of stopping and asking.
`--repo-url <URL>`	Install from a mirror of the Elpan repository.

Most options can also be given as environment variables (ELPAN_STAGING, ELPAN_ACME_URL, ELPAN_DATABASES, ELPAN_CLAMAV, ELPAN_PROFILE, ELPAN_REPO_URL), which is how a provisioning system passes them.

What the installer does

In order:

Disables SELinux (selinux=0 on the kernel command line).
Installs the EPEL, Remi and Elpan repositories and enables CRB.
Installs the quality-of-life tools, and the development toolchains unless --no-devtools.
Removes firewalld (Elpan has its own firewall) and installs the elpan package, the database engines of --with-databases and elpan-clamav if asked for. On the tiny profile the optional components are left out (Sizing profiles).
Stops and asks for a reboot, since the kernel command line changed (the SELinux setting, and the quota options you added).
After the reboot, and the same command again: starts the platform (elpan.service, now and at every boot), initializes the server with the hostname (server:init), creates the shared IP address groups, starts the database engines, and points the system resolver at Elpan's own resolver.
Installs Homebrew, unless --no-brew.

The installer records each completed step under /var/lib/elpan-install, so running it again skips what is done. Its output is in /var/log/elpan-install.log.

Why the reboot

SELinux is disabled on the kernel command line, which takes effect at boot, and Elpan is initialized only once it is off. The quota options on the root filesystem take effect at the same reboot.

What the installer leaves behind

A running platform. elpan.service starts every component at boot. systemctl list-dependencies elpan.service shows each one.
The admin app at https://admin.<server hostname>/, with no admin user yet. The admin app is the next step.
A splash page on the bare server hostname. The bare hostname is not the admin app; it serves a static Elpan page and the server API.
Elpan's resolver as the system resolver (10.91.3.53), set on the NetworkManager connection of the default route, or written to /etc/resolv.conf when NetworkManager doesn't manage it. The mail stack and the panel expect it.
The sizing profile. The admin app's home page shows which profile the host runs and what is not installed.

The installer ends with the next steps: create an account, link a billing system, set up backups. These docs cover them in Create an account, Billing systems and Backups.

Nobody reads the server's own mail yet

server:init leaves the destination of the system's mail (root, MAILER-DAEMON, Postfix alarms, copies of abuse reports) unset, and the installer doesn't set it. Until you do, that mail accumulates unread on the server. Set it right after the install:

elpanctl server:edit --admin-email=<address>

See System mail.

Before the installer​

Hostname​

Static addresses​

Quota options on the root filesystem​

Process privacy​

Run the installer​

What the installer does​

What the installer leaves behind​