This is an old revision of the document!
Table of Contents
Deploy and activate
This is the short deployment path. Read the repository README and security notes first.
Prerequisites
- A BinaryLane API token.
- An Ubuntu 24.04 VPS.
std-1vcpuor larger is recommended. - SSH access to the VPS.
- A DNS name for public HTTPS, or a VPC, VPN, bastion, or SSH tunnel for private access.
Warning: Do not paste the BinaryLane API token into cloud-init. The activation script asks for it after first boot and stores it in /opt/bl-proxy/.env with root-only permissions.
1. Create the VPS
Review and copy the current raw cloud-init payload into the cloud-init or user-data field when creating the VPS.
The payload installs the project under /opt/bl-proxy and pulls the container images. It does not start the public proxy listener or contain your API token.
Wait for cloud-init to finish, then connect over SSH. You can check cloud-init with:
sudo cloud-init status --wait
2. Activate the gateway
sudo /opt/bl-proxy/scripts/activate.sh
The script asks for the BinaryLane API token, access mode, and initial users.
Choose public HTTPS only after a DNS A record points to the VPS. Caddy will obtain and renew the certificate. Choose private HTTP only when traffic is protected by a VPC, VPN, bastion, or SSH tunnel; never expose plain HTTP directly to the internet.
3. Verify the result
sudo cat /opt/bl-proxy/DEPLOYMENT-NOTES.txt sudo /opt/bl-proxy/scripts/status.sh
Confirm that ports 9080, 9180, and 2379 are not reachable externally. Only SSH from trusted addresses and ports 80/443 where needed should be exposed.
Continue with Users, roles, and JWTs.