There is no build step. Production needs Node.js, PostgreSQL, a public DNS name and TLS — and the installer arranges all four. Pick the path that matches how you run servers.
| Path | TLS | Best for |
|---|---|---|
| Debian / Ubuntu installer | certbot, or --no-tls behind your own proxy | The recommended bare-VM path. Provisions PostgreSQL; upgrades are idempotent. |
| Docker Compose + Caddy | Caddy provisions and renews automatically | Containerized, reproducible, self-healing. |
| Generic systemd + certbot | The relay terminates TLS itself | A non-Debian VM. Does not provision PostgreSQL for you. |
Option 1 — Debian or Ubuntu (recommended)
Download the release, extract it, and run the installer from the extracted folder. It re-runs itself under sudo if you forget.
tar -xf secure-desk-*.zip # or unzip
cd rubix-remote
sudo bash install.shThat installs Node.js, PostgreSQL and certbot, creates the database role (its password is generated once and reused), installs the systemd service, and applies the schema on boot. To have it obtain a certificate at the same time, drive the engine directly:
sudo relay/deploy/install-debian.sh \
--domain support.example.com \
--email ops@example.comFind the setup token
Until setup is complete the relay funnels every request to /setup and will only accept a one-time token that it printed to its log:
sudo journalctl -u rubix-relay -e | grep -i 'setup token'Then open https://support.example.com/setup, paste the token, and create the admin account. The wizard also takes the listening port, the Let's Encrypt domain and contact address, and the public base URL to use in emailed links when you are behind a proxy.
Set the public base URL if you run behind a proxy. The portal builds join links from it. Get it wrong and the links you email users point somewhere they cannot reach — which looks exactly like the relay being down.
Other installer flags
| Flag | What it does |
|---|---|
--port N | Listen on a different port. |
--uninstall | Remove the service. Keeps the database and data. |
--factory-reset | Wipe accounts, settings and data; keep the application. Back to /setup. |
--purge | Destructive. Removes everything, database included. |
--reset-http | Recovery: revert to plain HTTP on port 80 when a TLS change has locked you out. |
Option 2 — Docker Compose + Caddy
Caddy obtains the certificate over HTTP-01/TLS-ALPN and proxies WebSocket upgrades transparently. Certificates persist in the caddy-data volume, relay configuration in relay-data.
cd relay
cp .env.example .env # set DOMAIN + ACME_EMAIL
# point DOMAIN's DNS at this host; open ports 80 and 443
docker compose up -d --build
docker compose logs relay | grep -i 'setup token'
# then open https://DOMAIN/setupBuild with the repository root as the context — the server resolves sibling static directories (portal/, join/, agent-web/, setup/). The supplied docker-compose.yml already sets context: .. for this reason.
What gets served
| Path | Who uses it |
|---|---|
/ and /join | The public join page. A user opens a link, or types the code they were given. |
/portal | Technicians. Sign in, create and share sessions, browse enrolled devices, open the console. |
/console | The browser support console. Normally opened from the portal with the session prefilled. |
/setup | First-run wizard. Closes itself once the deployment is configured. |
Database
Production uses PostgreSQL; point DATABASE_URL at it, or let the Debian installer provision one locally. Without it the relay starts against an in-memory store and loses every account, session and device on restart. That mode exists so a developer can run it in one command — it is not a deployment.
Upgrading
Re-run the same installer command. It re-syncs the code, runs npm ci, re-applies the schema and restarts the service, preserving the database, the generated secrets and data/config.json. Under Docker, rebuild and bring the stack back up.
Windows clients are a separate story: once enrolled they update themselves from your relay. See Licensing & updates.
Then license it
An unlicensed relay runs as free Starter — one technician, one concurrent session, three devices. To lift that, request an activation code, read the Device/Node ID from Settings → License, and activate.