Install the on-prem platform

Journey overview · Next: activation and keys

Before installation

For supported Linux VM deployments, verified customers can choose Start 14-day evaluation at OnPrem Access. Supply the intended hostname; ownership proof is not required yet. The server selects the latest tested compatible standard image. Check image-download preparation, retrieve the installation key securely and follow the selected command shown in your request. Deployment targets do not create separate product builds. See evaluation issuance and limits.

Use the deployment planner to preview commands for an on-site, AWS, Azure, Google Cloud or other Linux VM. Enter your final choices in the access request. These targets use the same supported installer; your infrastructure team first creates the VM, networking, DNS and identity configuration. Kubernetes and private-edge selections require architecture review and a separate agreed runbook; the planner does not claim to provision them automatically.

What resources and limits apply?

These proxy limits do not override cloud endpoint limits or your partner rate-limit tier. Resource fields in the form are planning inputs, not reservations or enforced container quotas.

Host prerequisites

• Obtain an approved organization and authorized accounts. A 14-day self-service evaluation or an administrator-reviewed evaluation permits sandbox-only installation; production requires separate confirmed activation.
• Prepare a Linux AMD64 or ARM64 host with Docker Engine, Docker Compose and Python 3. Capacity is agreed during onboarding; no universal sizing guarantee is implied.
• Control an exact HTTPS installation domain. TXT or CNAME ownership proof is required before production activation; evaluation installation can precede it. Point A and any AAAA records to working addresses; remove stale IPv6 records.
• Allow inbound 80/443 as required by your HTTPS proxy and certificate challenge. Keep the application port private (default loopback port 3000).
• Allow DNS and outbound HTTPS to MyStocks, Firebase authentication and your approved image registry. Maintain accurate system time.
• Obtain a domain-bound license through a secure channel, registry reader access and an immutable approved image digest. Registry access and the installation license are separate credentials.
• Have the identity administrator register your installation domain in the authoritative Firebase project's authorized domains.
• Use Safari 16.4+, Chrome 111+ or Firefox 128+ for the workspace.

Which installer version should we use?

These commands were checked against installer revision ce0c36171 on 3 October 2026. Obtain the approved image digest from onboarding; the installer and image have separate versions. The download URL serves the current installer. Verify its checksum before running this revision:

curl -fsSLo install-onprem.sh https://mystocks.africa/install-onprem.sh
printf '%s  %s\n' '062a79c154403945abb7a2f63097d52e2b85869f3d2c079a11d5247281bf4e5b' 'install-onprem.sh' | sha256sum --check -
bash -n install-onprem.sh

Stop on checksum mismatch and obtain reviewed release instructions. Do not bypass the check or assume an updated script is compatible with an older image. Keep the verified script with the release record.

Default installation: Docker and Caddy

Authenticate Docker to the registry specified in your release instructions before installation. Download and review the installer; do not pipe an unreviewed script into a privileged shell.

curl -fsSLo install-onprem.sh https://mystocks.africa/install-onprem.sh
# Review the file. Replace the domain and image with approved values.
sudo bash install-onprem.sh --domain trading.example.com \
  --image REGISTRY/IMAGE@sha256:DIGEST \
  --mode docker --proxy caddy

Enter the license at the hidden terminal prompt. For automation, use --key-file PATH with a file readable only by its owner; never put a license in command arguments, shell history or browser code. The installer verifies the license before pulling the image and writes a protected environment file under /opt/mystocks by default.

The installer uses flags rather than an interactive deployment-choice menu. Docker and Caddy are the defaults.

Select a proxy

Preserve the verified domain's Host header, keep upstream port 3000 private, and disable response buffering for server-sent events. Do not disable TLS certificate verification. The generated installer configuration differs from the repository's example Compose networking; use one complete configuration rather than mixing fragments.

Exact proxy commands

After verifying the script, set your approved values. The digest must contain 64 hexadecimal characters:

DOMAIN='trading.example.com'
IMAGE='REGISTRY/IMAGE@sha256:DIGEST'
# Choose ONE command matching your prepared infrastructure:
sudo bash install-onprem.sh --domain "$DOMAIN" --image "$IMAGE" --mode docker --proxy caddy
sudo bash install-onprem.sh --domain "$DOMAIN" --image "$IMAGE" --mode docker --proxy nginx
sudo bash install-onprem.sh --domain "$DOMAIN" --image "$IMAGE" --mode docker --proxy traefik --traefik-network proxy
sudo bash install-onprem.sh --domain "$DOMAIN" --image "$IMAGE" --mode docker --proxy none

Do not run all four alternatives. Nginx needs your installed TLS certificates; Traefik needs the existing proxy network, entrypoint and resolver described above. Use --output-dir consistently when your approved installation directory differs from /opt/mystocks.

Native service option

Use --mode bare-metal --proxy nginx or --proxy none on Debian 12 or Ubuntu 24.04 with Node.js 22 and systemd. Docker is still required to extract the matching glibc image bundle. The application runs as a dedicated unprivileged service user; this is not a Docker-free installation path.

sudo bash install-onprem.sh --domain "$DOMAIN" --image "$IMAGE" --mode bare-metal --proxy nginx
# Or use --proxy none with your independently managed TLS ingress.

Verify before accepting traffic

curl --fail --show-error https://trading.example.com/api/live
curl --fail --show-error https://trading.example.com/api/health

Liveness alone is insufficient. Confirm readiness, certificate hostname and chain, authorized sign-in and a read-only API call. Then test authorized sandbox workflows, rejection of anonymous/cross-partner requests, and restart recovery in a dedicated test installation. --render-only produces configuration with an invalid fixture credential; it does not deploy or verify a working installation.

Continue with API connectivity and operations.

Which release can an administrator approve?

The administration workspace offers tested releases registered after a successful manual image publication. Registration checks the exact GitHub source commit, successful release and publish jobs, the registry's digest bytes, its source tag and its Linux AMD64/ARM64 index. Activation rechecks the approved record, requested architecture and operating system inside its transaction. A retired or incompatible release cannot be substituted. New customer retrieval requires Ed25519 identity support.

The email includes the selected immutable image and commands tailored to the request's approved mode, proxy, domain, port and Traefik network. The image is obtained from the private registry with separate reader credentials; it is not an email attachment. No passwords or private keys are emailed.

How do VM targets differ?

For every VM target, keep the application port private and expose the chosen exact domain through HTTPS. Caddy requires a reachable certificate challenge on ports 80/443. Nginx requires the operator's certificate files and nginx -t. Existing Traefik requires the chosen external Docker network, websecure entrypoint and letsencrypt resolver. External ingress must preserve Host and avoid SSE buffering. Test the actual firewall and certificate chain after installation; rendered configuration alone does not prove public reachability.

Which new installation errors require action?