Provision Soviez ERP from one shell line.

Confirm the host before piping the installer. HTTPS with a real FQDN is mandatory—plain HTTP or bare IP addresses will not keep login sessions (secure cookies).

OS

Ubuntu 22.04 LTS or 24.04 LTS (Debian-based). Debian 11 / 12 are also supported.

Hardware

Minimum 2 vCPUs, 4 GB RAM + 2 GB swap, 20 GB+ free SSD. 8 GB+ RAM recommended for production operator load.

Network

Ports 80 and 443 must be open and available. Publish a valid DNS A / AAAA record pointing at the server's public IP. Outbound pulls for postgres:16 and soviez/soviez-erp:latest are required.

Permissions

Most modes require a user with sudo / root privileges.

DevOps teams should know the mutation surface before piping to bash. The wizard separates host bootstrap from tenant launch, fails closed with set -euo pipefail, and never overwrites an existing tenant env sheet.

1. 1

   Environment check

   Verifies a supported Debian-family OS and elevates via sudo/root. Quiet status tags ([WAIT] · [OK] · [WARN] · [ERROR]) stream to the terminal while full traces append to /var/log/soviez_setup.log.

2. 2

   Host dependencies (--init)

   Installs or upgrades Docker Engine, configures Nginx (body size + long proxy timeouts + websocket upgrade map), installs Certbot with the Nginx plugin, and opens UFW for ports 22 / 80 / 443. No ERP containers are started here—host prep is intentionally separated from tenant launch.

3. 3

   Configuration wizard (--new)

   Detects the public IP, prompts for the target FQDN (entered twice, normalized), then validates DNS with getaddrinfo until the record matches—or offers a careful force path if you accept temporary mismatch.

4. 4

   Provisioning & isolation

   Allocates the next tenant index, writes a mode-600 .soviez_N.env secrets sheet, pulls postgres:16 (pinned) and soviez/soviez-erp:latest, then creates a dedicated Docker network, volumes, MAC address, host port (from 8073), and addons bind-mount under /etc/soviez_web_N/addons.

5. 5

   Secure routing (Nginx + Let's Encrypt)

   Publishes an Nginx vhost on the detected public IPv4, binds :443 with a baseline self-signed certificate first (so panels cannot capture HTTP-only traffic), then runs Certbot. On ACME failure the self-signed cert remains online—set Cloudflare SSL/TLS to Full and retry --formssl if needed. Verification expects header X-Soviez-Tenant.

6. 6

   Spin up & lock down

   Starts soviez-db-N and soviez-web-N, bind-mounts the host license ledger (~/.soviez), prints the one-time Database Master Password, and leaves you on HTTPS. Day-2 modes (--update, backup, Safe Shield staging) keep operator control without a vendor control plane.

There is no privately documented silent-domain flag—provisioning is driven by published modes that CI/CD and Ansible can download, review, and invoke under your change window. Domain entry for --new remains an interactive wizard (DNS validation is part of the safety model). Automate the surrounding steps; invoke only the public CLI surface below.

Canonical bootstrap sequence (download → host init → DNS → tenant):

curl -sSL https://soviez.sh | bash

# Or explicit download + modes:
curl -fsSL https://raw.githubusercontent.com/agharaafat/soviez-deploy/main/soviez.sh -o soviez.sh
chmod +x soviez.sh
sudo ./soviez.sh --init
sudo ./soviez.sh --new

Day-2 and inventory modes for pipelines and break-glass ops:

# Host bootstrap (Docker, Nginx, Certbot, UFW) — no ERP containers yet
sudo ./soviez.sh --init

# Provision an isolated tenant (Postgres 16 + web + HTTPS)
sudo ./soviez.sh --new

# Inventory / observability
sudo ./soviez.sh --list
sudo ./soviez.sh --monitor
sudo ./soviez.sh --logs soviez-web-1

# Heal incomplete setup or repair TLS only
sudo ./soviez.sh --formsetup
sudo ./soviez.sh --formssl erp.example.com

# Day-2: update image + schemas (volumes & licenses preserved)
sudo ./soviez.sh --update

# Backup / Safe Shield staging
sudo ./soviez.sh --backup soviez-web-1 production
sudo ./soviez.sh --stage soviez-web-1 production
sudo ./soviez.sh --dropstage soviez-web-1 stage

Tenant refs accept forms such as 1, soviez-web-1, or the web container name. --dropstage aborts unless database.is_neutralized=True (Safe Shield).

When --new finishes, vault the Database Master Password shown once on screen—it unlocks the Web Database Manager. Open the printed https://your.domain URL, create the company database, then activate licensing.

On the activation screen, paste your offline-capable, Ed25519-signed license key minted from your dashboard on soviez.com. The key is bound to the instance fingerprint (HARDWARE_HASH::DATABASE_UUID) and verified locally by local_license_guard—no phone-home required to stay unlocked.

• Confirm HTTPS loads the Database Manager or login screen
• Store the Master Password in your secrets vault
• Optional: drop custom addons in /etc/soviez_web_N/addons
• Optional: schedule periodic --backup under /var/soviez/backups

Mid-flight Nginx/SSL failures: re-run sudo ./soviez.sh --formsetup. TLS-only repairs: --formssl.