Help · Operators

Install Command

After you register a node, the dashboard prints a command to run on your server. It installs the agent, which connects to ProofKit and sets the node up. Docker (any Linux, x86-64 or ARM) or bare metal (systemd, x86-64 only).

Open in the app All help topics
example
curl -fsSL https://proofkit.org/install.sh | bash -s -- \
    --mode=docker --type=origin --token=<token from the dashboard>

When you register a node, the dashboard shows its install command. SSH into the server and run it as root. The agent installs, connects to ProofKit, and the node turns active once its first heartbeat arrives.

Docker

Runs the agent in a container. In the single layout the agent's container starts Xray and nginx itself. In the split layout a second container, the data plane (dvpn-dataplane), runs them and the agent only asks it to. A new install is split when the agent image it pulls is version 0.5.0 or later, and Updating the Agent says how an older node moves. Needs Linux with kernel 5.6 or newer and Docker; it installs to /opt/proofkit-dvpn with a Watchtower container that keeps the images up to date. A good choice on Debian, Ubuntu and most other distributions.

Bare metal (systemd)

Downloads the agent binary and runs it as a systemd service that manages Xray, nginx and WireGuard. The dashboard labels it for AlmaLinux 10+ / CentOS Stream 10+. It runs on x86-64 only.

Before you start

  • A ProofKit account. Sign up and enter the code we email you. You choose no role: the first node you register makes the account an operator account, and the role stays with it. An operator account can't connect to the VPN, so use a separate user account for that.
  • TON: 1 TON deposited per node for its stake, and some TON left in your wallet for the gas of claims and withdrawals.
  • A server: x86-64 (amd64) or ARM (aarch64), with a public IPv4 address and root access; the Docker install runs on both, the systemd service on x86-64 only.
  • Open ports in the hosting provider's firewall: see Endpoint host.

Flags

  • --token=<token>: the node's agent token, from the dashboard.
  • --type=origin|edge: matches the registration.
  • --mode=docker: Docker instead of systemd.
  • --country=XX: the two-letter country code.
  • --sni=<host>: the cover site, when you set one.
  • --warp: Cloudflare WARP for outgoing traffic (origins). The command carries it while WARP is on for the node; it mirrors the switch ProofKit sets and is not a way to change it.
  • --torrent-guard: Torrent Guard (origins).
  • --tunnel=gre_ipsec: installs strongSwan for GRE+IPsec.
The token is a secret: anyone who has it can run an agent as your node. It does not expire by time; the agent replaces it with a new one when it connects. Lost the command? Reinstall makes a new one.