Step 1 of 8 · Docker

Linux with Docker

Run install.sh on your Linux server and open the appliance on port 8443.

What you need

A Linux server with 4 GB RAM and 20 GB of free disk space.
Docker 24.0 or later with Compose v2, plus Python 3. The script offers to install Docker if it is missing.
Access as root or a user with sudo.

Run install.sh

Log in to the server as the user who will own the installation and run:
Terminal window
```
bash <(curl -fsSL https://sslbrain.com/install.sh)
```
Accept the script’s suggestions. If it adds your user to the docker group, it stops: log out and back in, then run the same command.
Wait while the script downloads the appliance, checks its signature and starts it. This takes up to 5 minutes.

Open the appliance

Open the address printed by the script, for example https://192.168.1.20:8443/setup.
Continue past the browser’s warning about the self-signed certificate.

Check that it works

The script shows sslbrain is running. The browser shows Log in with sslbrain Cloud. Include port :8443 in the appliance address.

Next step

Continue with 2. First-time setup.

If it fails

The script stops with code 2 → install what the error names and run the script again.
The script stops with code 3 → the signature could not be approved. The appliance has not started. Download the script again and see No connection to sslbrain Cloud (EU).
The script stops with code 4 → read docker logs sslbrain and data/control/controller.log in the deployment directory.
The browser cannot open the page → run docker ps. The sslbrain container must be healthy and port 8443 must be open from the client to the server.
The log shows Permission denied on /data → run sudo chown -R 1000:1000 ~/sslbrain/data. Use your deployment directory if it differs.
The appliance cannot reach sslbrain Cloud → check Network and firewall.

The appliance’s data

Everything the appliance stores is in the data directory inside the installation directory, ~/sslbrain/data by default. The container sees it as /data. It holds the database, the vault, the appliance’s keys and the backups you take in the web interface.

The directory must be owned by user and group 1000. The script sets this itself.
Never delete or move the directory while the appliance is running.
Copy backups off the server. See Save a backup.
The host controller’s log is ~/sslbrain/data/control/controller.log.

Behind a reverse proxy

Put the proxy’s address or network in TRUSTED_PROXIES in docker-compose.yml, for example TRUSTED_PROXIES=10.0.0.5,192.168.50.0/24. Then recreate the container with docker compose up -d. Without that line, the appliance does not trust the proxy’s X-Forwarded-For. If the proxy runs on the same server, its traffic comes from the Docker network’s gateway (docker network inspect), not from 127.0.0.1.

What the script installs

You maintain the server’s operating system and Docker yourself.

docker-compose.yml and two public keys for the signature check in the installation directory, ~/sslbrain by default.
The host controller /usr/local/bin/sslbrain-controller. It carries out the updates, restarts and restores you start from the web interface, and starts the appliance again if it stops.
The cron entry * * * * * /usr/local/bin/sslbrain-controller, which runs the host controller every minute.
sslbrain-shutdown.service, if the server uses systemd. It stops the appliance cleanly when the server shuts down.

Script options

Option	Environment variable	What it does
`--deploy-dir <path>`	`DEPLOY_DIR`	Installation directory. Default `~/sslbrain`.
`--yes` or `-y`	`ASSUME_YES=1`	Answers yes to every question, for example for an unattended installation.
`--skip-cron`	`SKIP_CRON=1`	Creates no cron entry. The script prints how to run the controller instead.
	`DECLINE_DOCKER_INSTALL=1`	Does not install Docker if it is missing.
`--help`		Shows the options.

Exit codes

Code	Meaning
0	The installation is complete.
1	A required step was declined, or an option was invalid.
2	Something is missing on the server, such as Docker, Compose v2 or Python 3.
3	The signature on the appliance image could not be verified. The appliance has not been started.
4	The appliance did not answer within 5 minutes.

The compose file from Downloads

Downloads in sslbrain Cloud offers a compose file, docker-compose.yml. It starts the appliance on port 443 with its data in the Docker volume sslbrain-data. It does not install the host controller.

Without the controller, the appliance cannot update itself. Update it by hand in the directory containing docker-compose.yml:

docker compose pull && docker compose up -d

Add the controller to an existing installation

The paths below use the default directory, ~/sslbrain. Choose another with --deploy-dir.

Run the script on the same server:

bash <(curl -fsSL https://sslbrain.com/install.sh)

The script finds the running sslbrain container, stops it and copies its data from the volume to ~/sslbrain/data. It keeps the installation ID, licence, certificates and port, installs the controller and its cron entry, and starts the appliance from ~/sslbrain.
Copy any settings you changed, such as TRUSTED_PROXIES, from your existing docker-compose.yml into ~/sslbrain/docker-compose.yml. Run docker compose up -d from ~/sslbrain to apply them. From then on, start the installation only from ~/sslbrain.
Check that the appliance runs. The Docker volume is left unchanged as a backup. Docker names it after the folder the compose file was in, for example sslbrain_sslbrain-data, and the script prints the name. Delete it yourself once the appliance runs.