Command line

deploy.shCopy Anchor Link

Installer and operations script for 宝塔 / aaPanel Compose deployments. Usage: ./deploy.sh <command>.

Arguments, unattended variables, files written, backup layout, and exit behavior: deploy.sh reference.

Node installerCopy Anchor Link

The console serves install.sh at /install.sh; it installs and enrolls edgeweir-node on a node. The install command generated by the console already carries --server and --ca-sha256; see Adding nodes.

export EDGEWEIR_TOKEN='<one-time token>'
curl -fsSL https://<console>/install.sh | sudo --preserve-env=EDGEWEIR_TOKEN bash -s -- \
  --server https://<console>:8443 --ca-sha256 <CA fingerprint>

OptionsCopy Anchor Link

<console> is EDGEWEIR_PUBLIC_URL, written into the script when the console serves it.

--token and --token=… are rejected: command-line arguments are visible in the process list.

VerificationCopy Anchor Link

Nothing downloaded runs before these checks pass. System requirements, the full flow, and installed files: Adding nodes.

Exit codesCopy Anchor Link

The script neither upgrades nor uninstalls. Node upgrades: Node upgrades.

Docker ComposeCopy Anchor Link

Run in the directory of compose.yml; add -f <file> for other Compose files.

Print only the setup token:

docker compose logs --no-color --no-log-prefix console \
  | sed -n 's/.*"setupToken":"\([^"]*\)".*/\1/p' | tail -n 1

/healthz returns {"status":"ok","version":"<version>"}. When EDGEWEIR_HTTP_PORT is not 3000, use that port. Upgrade and rollback steps: Versions, upgrades, and rollback.

ContainerCopy Anchor Link

edgeweir-healthcheck: with ROLE=worker it returns 0; other roles request http://127.0.0.1:${PORT}/healthz with a 2-second timeout and return non-zero on failure.

Environment defaults of the image: Environment variables.

ROLECopy Anchor Link

Values: all (default), app, and worker. Components, listeners, and scaling per role: Deployment overview.

Account recoveryCopy Anchor Link

dist/server/recover.js resets the password of the console's only account and turns two-factor authentication off, for when nobody can sign in. It reads the same environment variables as the console (DATABASE_URL, EDGEWEIR_MASTER_KEY, and so on) and changes the database directly, without the web UI or HTTP. Steps: Account recovery.

docker compose exec console node dist/server/recover.js --reset-password --disable-two-factor

OptionsCopy Anchor Link

At least one of --reset-password and --disable-two-factor is required.

New passwordCopy Anchor Link

docker compose exec -T console node dist/server/recover.js --reset-password < new-password.txt

-T allocates no terminal; use it only with a pipe or file, because a password typed at the terminal is then shown on screen. The password is never taken from a command-line argument or an environment variable: arguments are visible in the process list and the shell history.

ResultCopy Anchor Link

These changes commit in one transaction with the audit entry; if any step fails, nothing changes:

Name, email, passkeys, and AccessKeys do not change. Standard output shows the account's name and email and what changed, never the password, its hash, or a session token:

Account: Ops <admin@example.com>
Password reset.
Two-factor authentication turned off.
Signed out 2 sessions.

Exit codesCopy Anchor Link

DevelopmentCopy Anchor Link

Requirements: Node.js 24.11.0 or later, pnpm 12.6.0, Docker; helpers/certd and pnpm e2e also need Go 1.27.1. buf is installed with the dev dependencies.

Run locallyCopy Anchor Link

1. Install dependencies.

   Copy Text

   pnpm install

2. Start the development database (compose.dev.yml; port: DEV_POSTGRES_PORT).

   Copy Text

   docker compose -f compose.dev.yml up -d

3. Create .env and set EDGEWEIR_MASTER_KEY (openssl rand -base64 32). The template's DATABASE_URL matches the development database.

   Copy Text

   cp .env.example .env

4. Start the console.

   Copy Text

   pnpm dev

5. Verify.

   Copy Text

   curl -s http://localhost:3000/healthz

   Expected output: {"status":"ok","version":"dev"}.

Certificate issuance needs the certificate helper: cd helpers/certd && go build -o bin/edgeweir-certd ., then set its absolute path in EDGEWEIR_CERTD_BIN.

CommandsCopy Anchor Link

Run from the repository root.

End-to-end testsCopy Anchor Link

scripts/e2e.sh runs against compose.e2e.yml. It needs curl, jq, docker, and node; the installer step also needs goreleaser v2, syft, Go 1.27.1, and the sibling edgeweir-node checkout, and the signed upgrade step needs cosign v3.1.3; the run needs access to deb.debian.org and openresty.org.

docker compose -f compose.e2e.yml up -d --build
pnpm e2e

Arguments follow the script: bash scripts/e2e.sh --up --down.

For a second environment on the same machine, change COMPOSE_PROJECT_NAME, the ports, E2E_TAG, E2E_SUBNET, and E2E_ISOLATED_SUBNET.