Zeabur

Deploy the console on a Zeabur Server with the console image and PostgreSQL 18: one-click template deployment, manual creation in the Dashboard, and the Zeabur CLI equivalents.

RequirementsCopy Anchor Link

TopologyCopy Anchor Link

General rules for ports and the node channel certificate: Ports, reverse proxy and trusted proxies.

One-click templateCopy Anchor Link

zeabur.yaml at the repository root is a Zeabur template, published as 5MQJR2:

1. Generate the master key:

   Copy Text

   umask 077
   openssl rand -base64 32 > edgeweir-master-key

2. Click Deploy on Zeabur at the top of this page and Deploy on the template page; when prompted, pick a project or create one on a Server, enter the domain prefix (giving <prefix>.zeabur.app) and the master key (the contents of edgeweir-master-key).

   CLI equivalent (run npx zeabur@latest auth login first); -f zeabur.yaml deploys a local copy of the template file:

   Copy Text

   npx zeabur@latest template deploy -c 5MQJR2

3. Pin the version, then initialize.

Template variables are written to every service of the project, so EDGEWEIR_MASTER_KEY also appears among the postgresql service's variables; PostgreSQL does not read it.

Manual creationCopy Anchor Link

Equivalent to the one-click template.

1. Generate the master key (as above).

2. Create Project, pick an existing Server, Buy New Server, or Bind External Server, and click Create Project.

3. Database: Deploy New Service → Databases → PostgreSQL. Zeabur's PostgreSQL template runs postgres:18 with port forwarding on (5432 reachable from the internet); turn it off:

   Copy Text

   npx zeabur@latest context set project
   npx zeabur@latest context set service --name postgresql
   npx zeabur@latest service port-forward --disable

4. Console: Deploy New Service → Docker Image, image ghcr.io/marvinli001/edgeweir:20260929-a1b2c3d (replace with the target tag).

   • Ports: web, 3000, HTTP; node, 8443, TCP.

   • Environment Variable:

     Copy Text

     PORT=3000
     DATABASE_URL=${POSTGRES_CONNECTION_STRING}
     EDGEWEIR_MASTER_KEY=<contents of edgeweir-master-key>
     EDGEWEIR_PUBLIC_URL=https://${ZEABUR_WEB_DOMAIN}
     EDGEWEIR_NODE_API_URL=https://${PORT_FORWARDED_HOSTNAME}:${NODE_PORT_FORWARDED_PORT}

   Click Deploy.

5. edgeweir service Domains → Generate Domain, giving <prefix>.zeabur.app.

6. edgeweir service Settings → Health Check, path /healthz.

Pin the versionCopy Anchor Link

The template deploys the latest image. Once the first deploy succeeds, pin the tag it runs:

1. Read the running version:

   Copy Text

   curl -fsS https://<prefix>.zeabur.app/healthz

   The version field is the tag, e.g. 20260929-a1b2c3d.

2. edgeweir service Settings → Service Image: change the second field (the tag) to that tag and click Save; the service restarts with the new image. CLI:

   Copy Text

   npx zeabur@latest context set service --name edgeweir
   npx zeabur@latest service update tag -t <that tag>

InitializationCopy Anchor Link

An uninitialized console logs the same setup token on every start.

1. edgeweir service Logs, filter for first-run setup. After a restart or redeploy the previous instance's logs are gone; the latest instance logs the token again.
2. The line's setupToken field is the setup token and its url field the setup wizard (<EDGEWEIR_PUBLIC_URL>/setup).
3. Open the wizard and enter the setup token; see Quick start.

CLI: npx zeabur@latest deployment log -t=runtime --service-name edgeweir | grep setupToken.

VariablesCopy Anchor Link

${KEY} expands when the service starts: the service's own variables first, then variables other services expose, then Zeabur's special variables. ROLE, HOST, and NODE_API_PORT keep the image defaults all, 0.0.0.0, and 8443. All variables: Environment variables.

VerificationCopy Anchor Link

openssl s_client -connect <host>:<port> </dev/null 2>/dev/null \
  | openssl x509 -noout -text | grep -E 'Issuer:|Subject:|DNS:'

Expected: issuer CN=Edgeweir Node Channel CA, O=Edgeweir. Any other issuer means a device in between terminates TLS.

Custom domainCopy Anchor Link

Do this before enrolling nodes.

1. Web console: edgeweir service Domains → Custom Domain, enter console.example.com, click Create Domain, and add the DNS record the page shows.

2. Node channel: add nodes.example.com to DNS as an A record for the port forwarding host (the public IP of the Zeabur Server); the port stays the same. With DNS on Cloudflare, turn the proxy off (DNS only). When the forwarding host or port changes, only this record or the node channel URL needs changing.

3. Change the variables (the service restarts):

   Copy Text

   EDGEWEIR_PUBLIC_URL=https://console.example.com
   EDGEWEIR_NODE_API_URL=https://nodes.example.com:<port>

   The node channel URL can instead be changed only under "Node channel" in System settings to https://nodes.example.com:<port>, without a restart.

4. Verify: run the curl command of Verification with the new domain, and the openssl command with nodes.example.com:<port> and -servername nodes.example.com.

Moving enrolled nodes to another node channel URL: Node channel URL and certificate.

UpgradeCopy Anchor Link

1. Back up the database; see Backup and recovery:

   • In the postgresql service, Overview → Command, run pg_dump -U edgeweir -d edgeweir -Fc -f /var/lib/postgresql/edgeweir.dump, download the file from Overview → Files, then run rm /var/lib/postgresql/edgeweir.dump;
   • or use the service's Backup page (Dev plan or higher; backups are kept 7 days).

2. edgeweir service Settings → Service Image, change the tag to the new version and click Save; or npx zeabur@latest service update tag -t <new tag>.

3. Verify:

   Copy Text

   curl -fsS https://<prefix>.zeabur.app/healthz

   Expected: version is the new tag.

Migrations, signature verification, and rollback: Versions, upgrades and rollback.

Node channel over WebSocketCopy Anchor Link

When port forwarding is unavailable, or nodes should only connect to an HTTPS domain, nodes can use the WebSocket entry on the web port: save wss://<prefix>.zeabur.app under "Node channel" in System settings, or remove EDGEWEIR_NODE_API_URL and set EDGEWEIR_NODE_API_WEBSOCKET=true. Nodes need edgeweir-node 0.2.0 or later; see The node channel's WebSocket entry.

LimitationsCopy Anchor Link