Installation files, ports, services and logs

This page is for the server administrator: what the installer created on the server and where to find it. Run the commands on the server as root or with sudo. In the examples, the installation directory is /opt/micator; if you installed with the --path parameter, use your own directory. In installations made before this release, the directory and some names are different — see the section on such installations.

Installation directory

The directory is owned by root and closed to other users.

The docker-compose.prod.yml and manifest.json files and the deploy/ and db/ directories are part of the release. On an update from the panel, they are replaced with the files of the new release, and manual edits in them are not kept.

Files outside the installation directory:

Installations made before this release

An installation made before this release keeps its directory and its names. Updating the tracker from the panel and updating the installation service do not rename anything. The documentation examples use the names of a new installation.

The other names on this page are the same for both installations: files inside the installation directory, Docker services, the TRACKER-PHP chain, the trk-php and trk-egress bridges.

The installation directory is chosen by the install.sh file, and the other names by the release the installation was made with. So the /opt/micator directory by itself does not mean the names are new: an earlier release installed by the current install.sh with the --bundle parameter, or by an earlier install.sh with the --path /opt/micator parameter, sits in this directory with the old names.

The list of volumes shows which names an installation has: sudo docker volume ls. Volumes starting with tracker_ mean the old names, those starting with micator_ the new ones.

A tracker moved to a new server by restoring from a backup gets the names of the release used to install the new server: a backup of the earlier installation does not carry its names over.

Access files

Only root can read the setup-access.txt file. It contains a link like http://203.0.113.10/setup/#key=… and a line “Code: …” («Код: …»). The file is needed to open the first-run wizard. After the wizard is completed, the code stops working and the file is deleted. With installation in the terminal, there is no such file.

There is no file with the owner password. The owner comes up with the password in the wizard or in the terminal; the installer does not write it to disk and does not show it. If the password is forgotten, the sudo micatorctl owner-password command sets a new one — see New owner password.

The .env.production configuration

The file is created during installation. It contains:

• the panel domain, the tracking domain, the email for certificates and the owner login;
• database passwords and server keys — the installer generates them randomly;
• the team name and logo, and the license key if it was entered in the wizard.

The owner password is not in the file. For the first launch, the installer writes only the password hash into it, from which the panel creates the owner account, and deletes the hash as soon as the panel has responded. After that, the password is changed in the panel, see My profile: password and time zone, or on the server with the sudo micatorctl owner-password command.

Do not edit the file manually. The installer, micatorctl check and the installation service read it in a strict format: lines like KEY=value without quotes or spaces. If the format is broken, the installer and micatorctl check stop with the message “The .env.production format has changed; check the configuration manually.” («Формат .env.production изменён; проверьте конфигурацию вручную.»)

Database passwords and server keys are created once and are not replaced automatically.

Ports and addresses

Only TCP 80 and 443 are published externally. The tracker's web server listens on them. The ports of the databases, PHP, the panel and the API are not published externally: requests to the panel and the API go through the web server.

After installation through the wizard, the address http://203.0.113.10 redirects to https://panel.example.com/login, and https://panel.example.com/setup/ to the /login page.

The web server issues HTTPS certificates by itself. For this, the domains' DNS records must point to the server, and ports 80 and 443 must be reachable from the internet.

The installer does not configure ufw and does not change access rules for SSH, 80 and 443. If a firewall is enabled on the server or at the hosting provider, ports 80 and 443 are opened manually — see Server requirements and preparation.

PHP network isolation

The micator-client-firewall program restricts the network for PHP from uploaded pages. It creates the TRACKER-PHP chain in iptables and ip6tables, attaches it to DOCKER-USER and closes the PHP containers' access to the server itself through the trk-php and trk-egress bridges. For the rules to work, it enables net.bridge.bridge-nf-call-iptables and net.bridge.bridge-nf-call-ip6tables. It does not reset other rules on the server.

• Regular PHP works without network access: outgoing connections are closed for it.
• PHP with network access reaches only public addresses over TCP 80 and 443, and DNS. Private and reserved networks, the server's own addresses and all of IPv6 are closed for it.

The rules are applied during installation, at server boot before Docker starts, and before each Docker start. Docker starts only after the rules are applied successfully. When a page needs PHP with network access is explained on the PHP in hosted pages and network access page.

systemd services

With installation through the wizard, micator-client-firewall.service and micator-updates.service appear after the Launch tracker («Запустить трекер») button; when restoring from a backup, after the Restore tracker («Восстановить трекер») button. The installer enables the docker service at boot.

sudo systemctl status micator-updates.service
sudo journalctl -u micator-updates.service -n 50

For another service, use its name. The log shows the reason if a service did not start. How to update the installation service itself is on the Updating the installation service (controller) page.

Docker services

All tracker containers belong to the Docker Compose project named micator.

The images are part of the signed release: the server does not download them from a registry and does not build them. After a server reboot, the services except pg-migrate and ch-migrate start by themselves unless they were stopped manually.

Until the tracker is launched from the wizard, ports 80 and 443 are held by the temporary micator-setup-edge container. The wizard removes it before launching the tracker.

Docker volumes

Databases, uploaded pages and certificates are stored in Docker volumes, not in the installation directory.

State and logs

The micatorctl command shows the installation state:

sudo micatorctl status
sudo micatorctl check

status prints the version and phase from install-state.json. check additionally checks the services and HTTPS once and, on success, prints “Services and HTTPS are responding.” («Сервисы и HTTPS отвечают.») The phase values and the other responses are on the install.sh parameters and installing in the terminal page.

The installer does not keep a separate log file: it prints messages to the terminal, and the wizard shows them on its page. The messages are explained on the Installation errors and how to fix them page.

Check the state and logs of the services through Docker Compose:

cd /opt/micator
sudo docker compose --project-name micator --env-file .env.production -f docker-compose.prod.yml ps -a
sudo docker compose --project-name micator --env-file .env.production -f docker-compose.prod.yml logs --tail 100 admin

Replace admin with a service name from the table above. Without a terminal, the tracker state is shown on the Status («Состояние») panel page; see System status.

What to keep off the server

• The owner password, for example in a password manager. It is not on the server, and the old password cannot be recovered — you can only set a new one with the sudo micatorctl owner-password command.
• Backups on a separate storage server. A backup includes the tracker data and .env.production with the server keys; HTTPS certificates are not included — see Creating a backup and the schedule. Connecting the storage is described on the Connecting a backup storage server page.
• Access to your account: it shows the license key.

With a backup, the tracker moves to an empty server; see Restoring on a new server. When restoring in the wizard, the license key is not taken from the backup: you enter it again, see Transferring a license to another server.