Skip to main content

​
Fased on Hetzner

Use the maintained Hosting installer on a normal Linux VPS. It creates the non-root application account, installs the independent native signer and root updater, configures systemd, joins Tailscale, hardens remote access, and keeps updates and rollback coordinated.
Do not run the full Docker Gateway on a Hetzner VPS. Docker Gateway support is Local only, and there is no install.sh --hosting-docker mode. On Hetzner, use install.sh --hosting exactly as shown below.

​
What you need

  • A Hetzner Cloud server with Ubuntu LTS (recommended)
  • Initial root SSH access, preferably with an SSH key
  • A Tailscale account
  • Tailscale installed and signed into the same tailnet on your own computer
  • The provider console/rescue path retained for emergency recovery
Use the general VPS sizing guidance before choosing a server. Do not open the raw Gateway port (18789) in a Hetzner firewall.

​
1. Create and enter the server

Create an Ubuntu LTS server in Hetzner Cloud and attach your SSH public key. Keep public SSH available only for initial bootstrap; the installer verifies the private Tailscale path before applying its remote-access hardening.
The remaining installation commands run inside that SSH session, not in a PowerShell or Terminal window on your local computer.

​
2. Run the Hosting installer

From the provider root console, follow the one-command Hosting guide. It verifies the tagged Hosting release before privileged Fased installation. Do not install Docker, Node, Go, or Fased globally first. When Tailscale prints a login URL, open that URL in the browser on your own computer and approve the server. Return to SSH only after the server appears in the correct tailnet. The installer stops before SSH/firewall lockdown if it cannot verify a valid tailnet address.

​
3. Verify private access

From your own computer, with Tailscale connected to the same tailnet:
If the initial provider login was password-only and no application SSH key was available, use Tailscale SSH:
Do not close the bootstrap session until private access works.

​
4. Verify Fased

As the app user on the VPS:
The install is ready only when health passes, the Gateway is running, the RPC probe succeeds, plugins are clean, and signer doctor reports the expected native protocol.

​
5. Open the Control UI privately

Keep the Gateway on loopback. If you need a direct browser tunnel, run this on your own computer:
Then open http://127.0.0.1:18790/. Use the dashboard/token instructions printed by the installer; never publish port 18789 to the internet.

​
Updates and repair

For a normal update, connect as app over Tailscale and run:
Use install.sh --hosting again only for an intentional hosted repair or reinstall. See VPS Hosting and Updating and rollback for the complete lifecycle and backup guidance.

​
Container note

Docker may still be installed on the same VPS for optional per-session Agent sandboxing while the Gateway and native signer remain managed by the host installer. That is different from running the full Gateway in Docker. See Sandboxing.