Self Host Layer
Get early access

Getting started

Installation

Install Self Host Layer with one command, finish setup in the browser, and the options the installer takes.

Run the installer

On a fresh server, as root:

curl -fsSL https://get.selfhostlayer.com | bash

It checks the server first: the OS and CPU, that systemd runs it, the free disk, that ports 80 and 443 are free, and the public IP address. If a check fails, it stops before changing anything.

When it's done, it shows a box with two things:

  • The panel's address, like https://203-0-113-7.sslip.io.
  • A one-time setup token.

Finish setup in the browser

  1. Open the address and paste the setup token.
  2. Create your account: an email and a password of at least 12 characters.
  3. Turn on two-factor sign-in: scan the QR code with an authenticator app and enter a code.
  4. Save the recovery codes it shows. Each one signs you in once, without your phone.

Until setup is done, the panel only answers the token holder, and only over HTTPS. Every sign-in after that asks for your password and a code from the app.

Next: deploy your first app.

Options

Pass options after bash -s --:

curl -fsSL https://get.selfhostlayer.com | bash -s -- --domain panel.example.com
Option What it does
--domain panel.example.com Serve the panel on your own domain. Its DNS must already point at the server. You can also move it later from Settings.
--apps-domain apps.example.com The base of every app's free address (<app>.apps.example.com). It needs a wildcard DNS record, *.apps.example.com. Without it, apps get <app>.<your-ip>.sslip.io.
--yes Answer yes to every question. With an SSH key present, this also turns off password logins for SSH.
--no-harden-ssh Leave the SSH settings alone.
--internal-tls Use Caddy's own certificate authority instead of Let's Encrypt, for test servers with no public address. Browsers will warn.
--updates-url <url> Where one-click updates come from. The default is https://get.selfhostlayer.com/releases.json.
--from-tarball <file> Install a release file you already have instead of downloading one.

Running it again

Running the installer again is safe. It checks and repairs everything, keeps your settings (the panel's address, the apps domain, the update feed), and prints a new setup token only until setup is done.

What it changes

In short:

  • On servers with less than 4 GB of RAM, a 2 GB swap file.
  • Caddy, ufw, fail2ban (watching SSH logins) and unattended security upgrades.
  • Official Node.js builds in /opt/layer/node/. There's no nvm, fnm or pm2.
  • The layer user for the panel, and the panel, the agent and the layer command in /opt/layer/.
  • A firewall that denies incoming traffic except SSH, 80 and 443.
  • If an SSH key is present and you agree: SSH password logins off, root only with a key.

Files and services lists every step and where everything lives. The full log is in /var/log/layer-install.log.