Installing cpleks

cpleks is installed on the server it manages. It takes over web serving on that machine, so start with a fresh server rather than one that already hosts sites another way. The software cpleks installs is called cplex: that is the name you will see in commands, services and folders on the server.

What you need

• A server running Ubuntu 24.04 LTS, Ubuntu 26.04 LTS or Debian 13, on amd64 (x86-64) or arm64, with systemd. Any other release is refused by name before anything is written.
• Root access over SSH (sudo).
• Nothing else answering on ports 80 and 443. cpleks serves websites with nginx; if nginx has to be installed and another web server holds those ports, the installer stops and says which one.
• A licence key is optional. cpleks installs and works without one; the licence only decides whether the panel can update itself (see Your licence).

PHP, database servers, mail and the rest are not part of the install. You add them later, one card at a time, on the Modules screen.

Choose an installer

There are three, and all three end by running the same installer inside the release, so the result is the same machine whichever you pick. The exact commands and files for the current release are on the Download page.

The online installer carries the publisher's public key. It downloads the release's signed manifest, checks the signature, checks the release archive against the manifest, and only then unpacks anything. A .run file checks its own contents against a checksum in its header, which catches a damaged download but cannot prove who published it; before you carry a .run to a machine with no network, compare its SHA-256 (sha256sum) with the line for that file in the release's signed manifest.

Install with the online installer

1. Open an SSH session to the server.
2. Paste the command from the Download page. It has this shape:

   curl -fsSL <installer address from the Download page> | sudo sh

3. If you already have a licence key, save it in a file (for example /root/cpleks.key), make the file readable by root only with sudo chmod 600 /root/cpleks.key, and pass it to the installer:

   curl -fsSL <installer address> | sudo sh -s -- --license-key-file /root/cpleks.key

   The installer refuses a key file other accounts can read. Without the option, and when it can reach your terminal, it asks Licence key (press Enter to install without one; you can add it later in the panel). A key is never taken on the command line, because every account on a server can read another process's command line.
4. Watch the lines beginning with ==>. The installer checks the platform, installs nginx and the few tools it needs if they are missing, and refuses any package plan that would remove a package already on the machine, saying which one, with nothing changed.
5. Read the report it prints at the end. It is written once and contains the only copy of the first password.

The two .run installers work the same way: copy the file to the server and run sudo sh cplex-<version>.run, with --license-key-file if you have a key, or --no-prompt to install without being asked.

What the report tells you

This is the sign-in part of a real report, from the test machine the screenshots in this guide were taken on, with the password and token replaced by dots:

SIGN IN. This is the only time these are shown.

  url        https://<this host>:8443/
  username   admin
  password   ····················

The panel will ask you to change that password before it lets you do anything
else, and it should: the line above is in this terminal's scrollback, and on a
cloud instance that is the console log, which is readable through the
provider's API for as long as the instance exists.

  api token  cplx_····

• The password is for your browser, and it works for one thing only: choosing a new one (First sign-in).
• The API token is for automation and expires in 24 hours. You can make longer-lived tokens with limited permissions in the panel later.
• Open ports are read off the firewall that is actually running, for example open: 22/tcp 53/tcp 80/tcp 443/tcp 2222/tcp 8443/tcp 53/udp.
• Host hardening: a default-deny firewall, kernel settings that keep accounts from watching each other's processes, and /tmp mounted so that nothing uploaded there can be run. SSH configuration and /etc/fstab are not touched.
• Certificates: a fresh install gets certificates from Let's Encrypt's staging service, which no browser trusts, until you switch it to production. See Certificates and HTTPS.

sudo -u cplex /usr/local/sbin/cplexctl harden confirm

A firewall in front of the machine

cpleks manages the firewall on the server. A cloud provider usually has another one in front of it (an AWS security group, for example), which cpleks can neither see nor change. Allow at least these there:

• 8443/tcp for the panel, 80 and 443/tcp for websites, 22/tcp for your own SSH.
• 2222/tcp for customers' SFTP (SFTP and FTP).
• 53/tcp and 53/udp if this server will answer DNS for your domains.
• The mail ports if you turn mail on: 25, 143, 587 and 993.

If something goes wrong

• Running it again is safe. The installer is idempotent: an existing administrator, database and TLS key pair are kept.
• Lost the password before you signed in (a dropped SSH session, a closed terminal): set a new one from SSH. It is read from an environment variable so that it never appears on a command line:

  CPLEX_PASSWORD='a long new password' sudo -u cplex --preserve-env=CPLEX_PASSWORD \
      /usr/local/sbin/cplexctl passwd -user admin

• The licence did not activate during the install (no network, a key already bound to another server): the install still finishes and the panel works. The report says so in one line, and you activate later from the panel.

Next: First sign-in and the one-time password.