VPS Hosting
Use a fresh Ubuntu LTS VPS for the simplest supported path. Fased installs the VPS-side Tailscale package from its signed operating-system repository; do not run Tailscale’s remotecurl | sh installer.
Install in 3 steps
1. Prepare your computer
Install and sign in to the Tailscale app on the computer where you will use Fased. Keep the VPS provider console available for recovery.2. Connect to the fresh VPS
3. Install Fased
After installation
Reconnect as the human operator, not as root or the Gateway service account:https://...ts.net/ URL from a device on the same tailnet.
The app operator uses the restricted signer lifecycle socket;
fased-gateway runs the Gateway and cannot use that operator authority.
Normal updates are also operator commands:
What the exact command verifies
What the exact command verifies
The streamed script accepts only a fresh
--hosting selector. It rejects
repair, release and source overrides, caller-supplied verification markers,
unsafe proxy or shell overrides, and existing Fased state.Before persistent Fased mutation, it resolves a stable tag and verifies the
offline GitHub attestation bundle for the release manifest. That manifest
binds the exact workflow, tag, source commit, architecture, application,
dependency layer, and signer digests. Archive paths, links, ownership,
writable modes, package version, and build identity are checked before the
tagged installer receives control.The first mutable main/install.sh download remains a bootstrap trust
assumption. Operators who require verification before any shell execution
should use the exact-tag procedure below.Advanced: verify install.sh before it runs
Advanced: verify install.sh before it runs
Follow the canonical
exact-tag pre-execution verification.
It authenticates the tagged
install.sh before Bash runs it and is the only
documented route for choosing a Hosting release override.Hosting repair and recovery
Hosting repair and recovery
Do not pipe If the streamed fresh install stops before
--repair-hosting from main. From the provider root console,
use the exact-tag verification block in the Advanced installer reference
and change only its final line:/var/lib/fased-installer
exists, fix the reported problem and rerun the exact normal command. If
persistent installer state exists, use exact-tag repair instead.Tailscale, VPN, and MagicDNS troubleshooting
Tailscale, VPN, and MagicDNS troubleshooting
Turn off another VPN while testing. From your own computer, try:
no matching peer usually means the devices use different tailnets. A
hostname-only failure usually means another VPN or DNS setting overrides
MagicDNS. tailscale ssh app@YOUR_VPS_TAILSCALE_NAME is the fallback when
regular SSH keys are unavailable.Minimal images and supported hosts
Minimal images and supported hosts
Ubuntu or Debian:Fedora or RHEL family:Hosting hardening supports Ubuntu, Fedora, and RHEL-family Linux with
systemd. Use at least 25 GB disk; 2 GB RAM is a practical small node.
Private-access boundary
Private-access boundary
Keep the Gateway private through Tailscale and retain provider-console plus
Tailscale-account recovery. Other VPNs, public proxies, and custom firewall
exposure are operator-managed deployments outside the normal installer.
Provider notes
Hetzner
Server creation and recovery notes.
DigitalOcean
Droplet creation and console recovery.
Oracle Cloud
Oracle Linux notes.
Advanced installer
Flags, restrictions, attestation, and repair.