All documentation
Getting started

Connect a server

One command turns a fresh Ubuntu 24.04 or 26.04 LTS VPS into a hardened server that Provisore manages.

Requirements

  • Ubuntu 24.04 LTS or 26.04 LTS, freshly installed, with no existing web server. Choose the matching release when you add the server. The connect command checks the release and stops if it finds something else.
  • Root SSH access.
  • At least 1 GB of RAM. Swift release builds need about 4 GB including swap, which provisioning adds.

The connect command

Choose New server from the + menu in the sidebar or from ⌘K, pick Connect existing server, and run the command it shows you as root on the new machine:

curl -fsSL 'https://provisore.com/v1/server-bootstrap/<token>' | bash

The script checks the OS release, installs Provisore's public key, and reports back. Provisioning then runs over SSH, and the page shows each step as it runs. The bootstrap token works once and expires after a short time.

On Hetzner you can skip the command. Connect a Hetzner Cloud API token with read and write access under Settings, Connections, Cloud providers, then choose Create on Hetzner Cloud. Provisore creates the machine and runs the bootstrap through cloud-init.

What provisioning does

  1. Checks the OS release and that the server is reachable.
  2. Creates the provisore deploy user with sudo.
  3. Installs base packages.
  4. Adds swap, sized for the machine.
  5. Configures the UFW firewall for SSH, HTTP, and HTTPS.
  6. Installs and configures fail2ban.
  7. Enables unattended security upgrades.
  8. Installs Nginx.
  9. Installs certbot.
  10. Verifies that logging in as the deploy user works.
  11. Hardens SSH by disabling root login and password authentication.

SSH hardening runs last, after the deploy-user login works, so a failure earlier in the run leaves you able to log in as root. Databases and caches (MySQL, PostgreSQL, Redis, Memcached) are installed per server when you ask for them. Language runtimes are installed the first time a site needs them.

If provisioning is interrupted

Each completed step records a marker in /opt/provisore/state. Run provisioning again and it resumes from the first step without a marker.

Choosing a release

The Ubuntu release is fixed when you add the server. There is no in-place upgrade, so moving from 24.04 to 26.04 means connecting a new server. Every runtime runs on both. Choose 24.04 if you plan to run Swift on a toolchain older than 6.4.0, which is where swift.org’s 26.04 builds start.

Tags

A server can carry up to 20 lowercase tags, set under its Settings, General. The Fleet page filters by tag, and both the sidebar’s fleet filter and ⌘K find a server by its tags.

Your own SSH access

Provisioning installs Provisore's key, not yours. For a shell of your own, add your public key to the team’s SSH key pool under Settings, Connections. Pool keys are attached to each server as it goes active. For a server that is already running, attach the key under its Settings, Access. See Firewall & SSH access.