install.sh parameters and installing in the terminal

The install.sh installer runs on the server with sudo. Without parameters, it prepares the server and prints a link to the first-run wizard — this path is described on the Installation page. Parameters are needed to set up the tracker in the terminal, choose a different directory or set the wizard IP manually.

General rules

• Parameters are written after the file name: sudo bash install.sh --path /opt/micator-2.
• A parameter that takes a value must be followed by one. Otherwise the installer responds “No value for …” («Нет значения для …»).
• For an unknown parameter, the installer responds “Unknown parameter: …” («Неизвестный параметр: …») and does nothing.
• Any of the --headless, --panel, --track, --email, --admin-email, --owner-password-file, --restore-env parameters switches to installation in the terminal. The wizard is not started in that case.
• When you run the installer again, pass the same parameters as the first time.

Parameter table

Domains are given without https://, port and path; internationalized names are in punycode. Over the network, the release is downloaded only over HTTPS: for any other protocol, the installer responds “Downloads are allowed only over HTTPS.” («Загрузка разрешена только по HTTPS.»)

Installing in the terminal

You will need a server and two domains, as for a regular installation — see Server requirements and preparation. The DNS records of both domains must point to the server IP before you start.

1. Download the installer with the first command.
2. Run it with the --headless parameter with the second command.
3. Answer four questions: Panel domain («Домен панели»), Traffic domain («Домен трафика»), Email for HTTPS certificates («Email для HTTPS-сертификатов»), Owner login («Логин владельца»).
4. Come up with an owner password and enter it twice: at the prompts Panel owner password (at least 12 characters) («Пароль владельца панели (не менее 12 символов)») and Repeat password («Повторите пароль»). The characters are not shown on the screen.
5. Wait for the line “Done. Panel: https://panel.example.com” («Готово. Панель: https://panel.example.com»).

curl -fsSLo install.sh https://install.micator.com/install.sh
sudo bash install.sh --headless

The password is at least 12 characters and at most 72 bytes: that is 72 Latin characters or 36 Cyrillic ones. The installer asks for it after checking the domains in DNS, before the installation starts. If the password does not fit the rules or the repeat does not match, the installer prints the reason and asks again; after the third failure it stops. The password is not written to disk and is not shown: only its hash reaches the server. Write the password down yourself, for example in a password manager.

To avoid prompts for the domains and login, pass all four values as parameters. The --headless parameter is then not needed:

sudo bash install.sh --panel panel.example.com --track track.example.com --email [email protected] --admin-email admin

If only some of the values are given, the installer asks for the rest in the terminal. It asks for the owner password in any case unless the password is passed in a file — see Installation without prompts.

As it works, the installer prints: “Downloading the signed release…” («Загружаю подписанный выпуск…»), “Preparing Docker…” («Подготавливаю Docker…»), “Downloading prebuilt images…” («Загружаю готовые образы…»), “Starting the databases, panel and tracker…” («Запускаю базы, панель и трекер…»). At the end, four lines:

Готово. Панель: https://panel.example.com
Логин владельца: admin; пароль — тот, что вы задали. Он не сохраняется на сервере и не показывается.
Новый пароль владельцу: sudo micatorctl owner-password
Проверка установки: sudo micatorctl check

In English: “Done. Panel: https://panel.example.com”, “Owner login: admin; the password is the one you set. It is not stored on the server and is not shown.”, “New owner password: sudo micatorctl owner-password” and “Installation check: sudo micatorctl check”.

If the installation stopped with an error, fix the cause and repeat the same command with the same values. The installer saves the accepted domains, email and login and does not ask for them again. If the error happened earlier — for example, the domain does not resolve in DNS yet — the questions will be asked again.

On a repeat, the owner password is asked for again only if the previous attempt stopped before the settings were written — for example, while downloading images. If the settings are already written, the password is not needed. The --owner-password-file file is not read in that case, and the installer prints “The owner password is already set in the started installation; the file is not read.” («Пароль владельца уже задан в начатой установке; файл не читается.»)

Installation without prompts

Without a terminal — for example, from a script or over ssh without -t — the installer cannot ask for the password. It stops before the installation starts: “No terminal to enter the owner password. Run the installation in a terminal or pass --owner-password-file FILE (owned by root, permissions 0600, one line with the password).” («Нет терминала для ввода пароля владельца. Запустите установку в терминале или передайте --owner-password-file ФАЙЛ (владелец root, права 0600, одна строка с паролем).»)

For such an installation, pass the password in a file:

1. Create a file accessible only to root and write the password into it as one line — the first two commands below.
2. Run the installer with all four values and the --owner-password-file parameter — the third command.
3. After the line “Done. Panel: …” («Готово. Панель: …»), delete the file — the fourth command.

sudo install -m 600 /dev/null /root/owner-password
sudo nano /root/owner-password
sudo bash install.sh --panel panel.example.com --track track.example.com --email [email protected] --admin-email admin --owner-password-file /root/owner-password
sudo rm /root/owner-password

The installer reads the file once and does not delete it; it reminds you of this with the line “The owner password was read from /root/owner-password. This file is not deleted: delete it yourself when you no longer need it.” («Пароль владельца прочитан из /root/owner-password. Этот файл не удаляется: удалите его сами, когда он больше не нужен.»)

File requirements:

• a regular file, not a symbolic link;
• owned by root with 0600 permissions: the file is closed to the group and other users;
• one line with the password; a trailing newline is allowed;
• the file is not empty and is no larger than 4 KiB.

The password is not passed as a command parameter, only in a file.

Differences from the wizard

In both cases, the owner password is not stored on the server and is not shown. There is no file with the password.

After installation, log in to the panel:

1. Open https://panel.example.com/login.
2. Enter the owner's Login («Логин») and the password you set during installation.
3. Click Log in («Войти»).

If the “Tracker access closed” («Доступ к трекеру закрыт») screen opens, enter the key in the License key («Ключ лицензии») field and click Activate («Активировать») — see Getting a key and activation.

Different installation directory

By default, the tracker is installed in /opt/micator. The --path parameter sets a different directory:

sudo bash install.sh --path /opt/micator-2

• The directory must look like /opt/name. The name may contain Latin letters, digits, _ and -.
• The directory must be empty or not exist. The installer creates it itself. A symbolic link is not accepted.
• The parameter works with both the wizard and installation in the terminal.
• The setup-access.txt file and the other installation files are in this directory. Databases and uploaded pages are stored in Docker volumes, not in it.
• When you run the installer again and with --update-controller, pass the same --path.
• The installer finds an installation made before this release in the /opt/tracker directory by itself: without --path, it works with that installation, not with /opt/micator. If there are installations in both directories, it stops with the message “Several installations found. Specify --path explicitly.” («Найдено несколько установок. Укажите --path явно.»)
• The parameter does not add a second installation to the same server: the installer finds the existing one and stops.

You do not need to give the directory to the micatorctl command: it remembers it during installation.

Setting the wizard IP manually

The wizard opens at the server's public IPv4. The installer looks for this address on the server's network interfaces. If there is no public address on them, the installer stops: “Could not determine the public IPv4. Pass --setup-ip with the server IP.” («Не удалось определить публичный IPv4. Передайте --setup-ip IP сервера.»)

sudo bash install.sh --setup-ip 203.0.113.10

• Only a public IPv4 is accepted. For a private address or IPv6, the installer shows the same message.
• The wizard responds only at this address and at the panel domain.
• The address is fixed when the wizard is prepared. Once the wizard link has appeared, running again with a different --setup-ip does not change it.
• With installation in the terminal, the parameter is not used.

The micatorctl command

The installer puts the micatorctl command on the server. With a wizard installation, it appears after the server is prepared; with a terminal installation, after the tracker has started and passed the readiness check.

Run check after the tracker has started. The check runs on the server itself and does not show whether ports 80 and 443 are open from outside. If the previous run of the installer in the terminal ended with an error, both commands print “The last attempt was interrupted at this phase.” («Последняя попытка прервалась на этом этапе.») after the version line. The responses are explained in the Where to see the installation state section.

Phase values

With a terminal installation, the command appears only after the readiness check, so it shows ready.

New owner password

The tracker stores only the hash of the owner password, so the old password cannot be recovered — you can only set a new one. In the panel, another owner does this; see Editing a user and resetting a password. Nobody sets the password of the installation owner in the Team («Команда») section: the installation owner changes it themselves in the My profile («Мой профиль») window, with the current password. If the password is forgotten or nobody can log in, root sets a new password on the server:

1. Connect to the server over SSH.
2. Run the command below.
3. Enter the new password twice: at the prompts New owner password (at least 12 characters) («Новый пароль владельца (не менее 12 символов)») and Repeat password. The characters are not shown on the screen.
4. Wait for the line “Owner password admin changed. Their open panel sessions are ended; API tokens were not changed.” («Пароль владельца admin изменён. Его открытые сессии в панели завершены; API-токены не менялись.»)

sudo micatorctl owner-password

The password requirements are the same as during installation: at least 12 characters, at most 72 bytes.

• Without parameters, the password of the installation owner is changed — the account with the login set during installation. If the owner login was changed in the panel or you need another owner, give the login: sudo micatorctl owner-password --email LOGIN.
• Without a terminal, for example over ssh without -t, the password is passed in a file: --password-file FILE. The file requirements are the same as during installation. The command does not accept installer parameters such as --admin-email and --owner-password-file.
• All open panel sessions of this owner are ended, and they need to log in with the new password. Sessions of other users and API tokens do not change; tokens are revoked in the panel, see API tokens.
• If login was locked after many failed attempts, the new password works immediately. The panel is not restarted, and traffic is not interrupted. The login rate limit per IP remains — see Login attempt limits.
• The change is recorded in the Audit log: context micatorctl, action owner_password, user root (micatorctl). The record does not contain the password. If the server has only the older trackerctl command, the record has trackerctl and root (trackerctl).

The command works only on an installed tracker. Until the wizard or the installer has finished, the password is set in them.

Command messages

Messages about the password file are the same as during installation; see the table below.

If something went wrong

The “Not ready: …” message at the end of the installation is covered in the Services not ready section, and the others on the Installation errors and how to fix them page. Where the files are and which services are created is on the Installation files, ports, services and logs page.