This is the short deployment path. Read the repository README and security notes first.
std-1vcpu or larger is recommended.
Warning: Do not paste the BinaryLane API token into cloud-init. The activation script asks for it after first boot and stores it in /opt/bl-proxy/.env with root-only permissions.
Paste the following into the cloud-init or user-data field when creating the VPS:
#include
https://raw.githubusercontent.com/01ax/binarylane-scoped-api-proxy/345182cc82741b702e9eaa792c34052bf9454b72/generated/bl-scoped-gateway-cloud-init.yaml
Cloud-init downloads the reviewed payload at first boot and processes it as though it had been pasted directly. The URL is pinned to a specific commit so repeated deployments use the same configuration. The VPS needs outbound HTTPS access to raw.githubusercontent.com during first boot.
You can open the copyable include file or review the complete payload before deploying. The include is only read at first boot; it does not update an existing VPS if the repository changes.
The payload installs the project under /opt/bl-proxy and pulls the container images. It does not start the public proxy listener or contain your API token.
Wait for cloud-init to finish, then connect over SSH. You can check cloud-init with:
sudo cloud-init status --wait
sudo /opt/bl-proxy/scripts/activate.sh
The script asks for the BinaryLane API token, access mode, and initial users.
Choose public HTTPS only after a DNS A record points to the VPS. Caddy will obtain and renew the certificate. Choose private HTTP only when traffic is protected by a VPC, VPN, bastion, or SSH tunnel; never expose plain HTTP directly to the internet.
sudo cat /opt/bl-proxy/DEPLOYMENT-NOTES.txt sudo /opt/bl-proxy/scripts/status.sh
Confirm that ports 9080, 9180, and 2379 are not reachable externally. Only SSH from trusted addresses and ports 80/443 where needed should be exposed.
Continue with Users, roles, and JWTs.