BaoTa Panel and aaPanel

Compose modesCopy Anchor Link

deploy.sh install writes the compose file for the selected database mode.

The image ghcr.io/marvinli001/edgeweir is public; the panel needs no registry entry or login. Tag format and version pinning: upgrade.en.md.

1. PrepareCopy Anchor Link

Other requirements: Deployment overview.

2. Install with deploy.shCopy Anchor Link

1. Download the script:

   Copy Text

   curl -fsSL -o deploy.sh https://raw.githubusercontent.com/marvinli001/edgeweir/master/deploy.sh

2. Run the installer and answer the prompts for install directory, database mode, database connection, console URL, and node channel URL. Prompts and defaults: deploy-script.en.md.

   Copy Text

   sudo bash deploy.sh install

   The default install directory is /www/dk_project/edgeweir when /www/server/panel exists, otherwise /opt/edgeweir. The console URL is the address browsers use, e.g. https://cdn-admin.example.com; the node channel URL defaults to https://<console domain>:8443.

3. Record the setup token printed at the end.

Unattended install (run as root; variables: deploy-script.en.md):

EDGEWEIR_YES=1 EDGEWEIR_DB=host \
EDGEWEIR_PUBLIC_URL=https://cdn-admin.example.com \
DATABASE_URL='postgres://edgeweir:<URL-encoded password>@127.0.0.1:5432/edgeweir' \
bash deploy.sh install

With EDGEWEIR_DB=bundled, leave DATABASE_URL unset.

3. Reverse proxy and HTTPSCopy Anchor Link

The panel's nginx terminates HTTPS and proxies to http://127.0.0.1:3000 (replace the port if EDGEWEIR_HTTP_PORT was changed).

• If file validation of the certificate fails, use DNS validation.
• Keep the default sent domain (Host): the console checks request origins against EDGEWEIR_PUBLIC_URL only.
• If the console URL given at install time is not https://, run ./deploy.sh config after the certificate is active and change it to https://.

Generic nginx configuration and headers: networking.en.md.

4. Set up and verifyCopy Anchor Link

1. Read the setup token (also printed by the installer):

   Copy Text

   cd /www/dk_project/edgeweir   # install directory
   ./deploy.sh setup-token

2. Open https://cdn-admin.example.com/setup and enter the setup token, name, email, and password to create the console account. Setup wizard: Quick start.

3. Verify the web console:

   Copy Text

   curl -s http://127.0.0.1:3000/healthz

   Expected: {"status":"ok","version":"<EDGEWEIR_VERSION from .env>"}.

4. Verify the node channel (from another host):

   Copy Text

   openssl s_client -connect cdn-admin.example.com:8443 -servername cdn-admin.example.com </dev/null 2>/dev/null \
     | openssl x509 -noout -issuer

   Expected: the issuer contains Edgeweir Node Channel CA.

Node release source and origin allow list are configured in System settings, see Clusters and system; GeoIP databases in Protection settings, see Protection settings; SMTP on the Alerts page, see SMTP. Adding nodes: Adding nodes; --server in the install command is "Node channel" in System settings (EDGEWEIR_NODE_API_URL while none is saved); to change it, see Node channel URL and certificate.

Node channel portCopy Anchor Link

stream block, mechanism, and verification: networking.en.md. Steps on BaoTa / aaPanel:

1. Check that the panel's nginx includes the stream module:

   Copy Text

   /www/server/nginx/sbin/nginx -V 2>&1 | grep -o -- '--with-stream[^ ]*'

   Expected: one line is exactly --with-stream. Without that line, use direct exposure.

2. Move the node channel to local 18443; keep EDGEWEIR_NODE_API_URL at :8443:

   Mode	Change
   bundled	.env: EDGEWEIR_NODE_API_PORT=127.0.0.1:18443
   host	.env: EDGEWEIR_NODE_API_PORT=18443, EDGEWEIR_NODE_API_HOST=127.0.0.1

   Copy Text

   ./deploy.sh start

3. The panel's /www/server/nginx/conf/nginx.conf already has a stream { } block that includes /www/server/panel/vhost/nginx/tcp/*.conf; do not add another stream block, or nginx -t fails with "stream" directive is duplicate. Create /www/server/panel/vhost/nginx/tcp/edgeweir.conf:

   Copy Text

   server {
     listen 8443;
     proxy_pass 127.0.0.1:18443;
     proxy_timeout 1h;
   }

   When the node channel's DNS name has an AAAA record, add listen [::]:8443; as well. Test and reload:

   Copy Text

   /www/server/nginx/sbin/nginx -t && /www/server/nginx/sbin/nginx -s reload

4. Verify as in section 4, step 4.

Install without the scriptCopy Anchor Link

Compose project in the panelCopy Anchor Link

1. Get a template: the output of bash deploy.sh template bundled (or host), or compose.baota.yml / compose.baota-host.yml from the repository.

2. Generate the .env content in the panel terminal (bundled):

   Copy Text

   cat <<ENV
   EDGEWEIR_MASTER_KEY=$(openssl rand -base64 32)
   POSTGRES_PASSWORD=$(openssl rand -hex 24)
   EDGEWEIR_PUBLIC_URL=https://cdn-admin.example.com
   EDGEWEIR_NODE_API_URL=https://cdn-admin.example.com:8443
   EDGEWEIR_VERSION=20260929-a1b2c3d
   ENV

   For host mode, replace the POSTGRES_PASSWORD line with DATABASE_URL=postgres://edgeweir:<URL-encoded password>@127.0.0.1:5432/edgeweir (append ?sslmode=verify-full for a cloud database).

3. Add the compose project: BaoTa Docker → 容器编排 → 添加容器编排; aaPanel Docker → Compose → Add Compose. Name it edgeweir, paste the template as the compose content, paste the previous output into the .env field (aaPanel .env Content), and create it.

4. Check the containers: edgeweir-console is healthy; bundled also runs edgeweir-postgres.

5. Set the trusted proxy in bundled mode: put deploy.sh in the compose directory and run ./deploy.sh restart; the script writes the Docker gateway address to EDGEWEIR_TRUSTED_PROXIES and recreates the containers. To set it by hand, use the address printed below; environment changes take effect after the containers are recreated.

   Copy Text

   docker inspect -f '{{range .NetworkSettings.Networks}}{{.Gateway}}{{end}}' edgeweir-postgres

6. Read the setup token and continue with section 4:

   Copy Text

   docker logs edgeweir-console 2>&1 | grep -o '"setupToken":"[^"]*"' | tail -n 1

Standalone containers without ComposeCopy Anchor Link

The panel's Create Container form cannot set the read-only root filesystem, tmpfs, and no-new-privileges hardening of the compose files. For that hardening, run the docker run commands in docker.en.md from the terminal.

1. Create the network edgeweir: BaoTa Docker → 网络; aaPanel Docker → Network → Add Network; or in the terminal:

   Copy Text

   docker network create edgeweir

2. Create two containers: BaoTa Docker → 容器 → 创建容器; aaPanel Docker → Container → Create Container.

   Field	edgeweir-postgres	edgeweir-console
   Image	postgres:18.6-alpine	ghcr.io/marvinli001/edgeweir:<dated tag>
   Network	edgeweir	edgeweir
   Ports	None	127.0.0.1:3000 → 3000; 8443 → 8443
   Volume	edgeweir-postgres → /var/lib/postgresql	—
   Environment	POSTGRES_USER=edgeweir, POSTGRES_DB=edgeweir, POSTGRES_PASSWORD=<output of openssl rand -hex 24>	ROLE=all, DATABASE_URL=postgres://edgeweir:<same password>@edgeweir-postgres:5432/edgeweir, EDGEWEIR_MASTER_KEY, EDGEWEIR_PUBLIC_URL, EDGEWEIR_NODE_API_URL, EDGEWEIR_TRUSTED_PROXIES=<gateway of the edgeweir network>
   Restart policy	unless-stopped or always	unless-stopped or always

   • Do not set EDGEWEIR_VERSION on the console container: inside the image it carries the running version.

   • Deployments that set BETTER_AUTH_SECRET keep the value.

   • Gateway address:

     Copy Text

     docker network inspect -f '{{range .IPAM.Config}}{{.Gateway}}{{end}}' edgeweir

   • If the form cannot bind the port to 127.0.0.1, use docker run in the terminal.

3. Upgrade: pull the new tag, remove edgeweir-console, and recreate it with the same settings and the new tag. Data stays in the edgeweir-postgres volume. Back up first, see backup.en.md.

Upgrades and backupsCopy Anchor Link

Run in the deployment directory:

cd /www/dk_project/edgeweir
./deploy.sh update                     # back up, then upgrade to the dated tag behind latest
./deploy.sh update 20260929-a1b2c3d    # upgrade or roll back to a given tag
./deploy.sh backup                     # back up to backups/<time>/
./deploy.sh restore backups/<time>     # back up, then replace the database with that backup

Rotating the master key: in .env, move the old value to EDGEWEIR_MASTER_KEY_PREVIOUS, write the new EDGEWEIR_MASTER_KEY, and run ./deploy.sh restart; once ./deploy.sh logs console shows no envelope uses EDGEWEIR_MASTER_KEY_PREVIOUS any more, delete that line and run ./deploy.sh restart again. Details: Rotating the master key.

Commands, backup layout, and abort behavior: deploy-script.en.md. Version policy and rollback constraints: upgrade.en.md. Restore: backup.en.md.

TroubleshootingCopy Anchor Link