Connect your server

Connecting a server means installing one small program on it, called the agent. It takes one command, once — the only thing 1ClickOps ever asks you to type into a server.

Run the command

You need a server running Ubuntu 22.04 or newer, or Debian 12 or newer, and a way to type into it, such as your host’s “Console” button. Ubuntu 18.04 and 20.04, and Debian 10 and 11, still work, with a warning that their makers no longer update them. Rocky Linux, AlmaLinux, Oracle Linux and Red Hat Enterprise Linux 8 or newer, CentOS Stream 9 or newer, Amazon Linux 2023, Fedora 43 or newer, openSUSE Leap 15.6 or newer, openSUSE Tumbleweed, Arch Linux and Alpine Linux 3.24 or newer work in beta, HTTPS included. Windows, Mac and any other system are refused before anything changes. On Alpine, first add the tools the command needs, and use root.

In the dashboard, press Connect a server. A window shows one command.
Press Copy command, paste it into your server, and press Enter.

The command looks like this:

Terminal — on your server

curl -sL https://<this site>/install.sh | sudo bash -s -- --token <your one-time code>

Copy the real one from the window; it has your code. It works once, and only for 15 minutes. After that, press Get a new command.

What it installs

A few small tools, if missing.
The agent, only if its signature matches a key built into the installer.
A key pair that identifies this server. The private half is made there and stays there.
A background service, so the agent restarts with the server.

Docker is installed the first time you deploy an app, if your server lacks it.

What the agent can and cannot do

The agent runs as root, the full administrator of your server, to install Docker, set up the web server, manage certificates and run your apps. So our instructions can change things there.

The agent asks 1ClickOps for work. Every instruction is signed, and it checks that first.
It carries out only a fixed list of built-in actions, such as deploying, restarting and backing up. Anything else is refused.
No instruction means “run this text on the server”. A command you give us, such as your build command, runs inside Docker, in a sealed box.

Some things it refuses even from us: How 1ClickOps protects your server.

Check the fingerprint

The command prints a line starting “Update-signing key fingerprint:” and a long code, the key agents are checked against. It should be exactly:

7cfb4aacbb58cb13b156c1a34327b75d6017efd5ac852be0667c173006cbfd97

If it differs, do not use that server with 1ClickOps; email support@1clickops.com.

Disconnecting

On the server’s Settings tab, Disconnect Server asks you to type the server’s name.

It removes the server from 1ClickOps, with everything recorded here about its apps. This dashboard can no longer update, back up, watch or restart them.
Your apps keep running, and their files and every backup stay on the server. About a day later the agent removes itself.