Deployment Overview of HestiaCP on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

Operating System: Ubuntu or Debian.
Privileges: Root access or sudo privileges are required for installation.
Network/Ports:
Port 8083 (Internal management port).
Port 443 (External HTTPS access via proxy).
System Configuration: BBR (Bottleneck Bandwidth and Round-trip propagation time) congestion control must be enabled.

FQDN of the final panel on the hostkey.in domain¶

The administration panel is accessible via a specific subdomain template:

Parameter	Value
Prefix	`hestiacp`
Domain	`hostkey.in`
Full template	`hestiacp{Server_ID_from_Invapi}.hostkey.in`

File and Directory Structure¶

The following directories are used for configuration and management:

/root/nginx: Contains the Docker Compose deployment files for the Nginx proxy.
/data/nginx/user_conf.d: Stores Nginx user configuration files.
/data/nginx/nginx-certbot.env: Environment file for Certbot configurations.
/etc/letsencrypt: Managed volume for SSL certificates (via Docker).

Application installation process¶

The installation of HestiaCP is performed using an official installation script provided by the developers. The process involves several stages:

System Preparation:
Enable BBR congestion control via sysctl.
Update and upgrade system packages.
Install essential dependencies including curl, wget, gnupg, ca-certificates, dnsutils, and others.
Script Acquisition: The installation scripts (hst-install-ubuntu.sh or hst-install-debian.sh) are downloaded directly from the official HestiaCP repository to the /root/ directory.
Automated Installation: The script is executed with several parameters pre-configured:
Hostname: Set according to the domain template.
Port: Configured to 8083.
Components: Apache, PHP-FPM, VSFTPD, Named (DNS), MySQL, Exim, Dovecot, ClamAV, SpamAssassin, Iptables, Fail2Ban, and API are all enabled.
User: An admin user is created with a predefined password.

Access Rights and Security¶

Security measures implemented during or after installation include:

Firewall: Managed via iptables and fail2ban to prevent brute-force attacks.
Mail Security: Integration of ClamAV (Antivirus) and SpamAssassin (Anti-spam).
User Management: The default system admin user is managed specifically to ensure the HestiaCP control panel functions correctly.

Databases¶

HestiaCP includes a full MySQL/MariaDB stack as part of its core installation to manage web applications and internal configuration data. Database storage is handled by the integrated service installed via the main script.

Docker Containers and Their Deployment¶

A Nginx proxy container is deployed using Docker Compose to handle SSL termination and traffic routing.

Nginx-Certbot Container

Image: jonasal/nginx-certbot:latest
Network Mode: host
Restart Policy: unless-stopped
Environment Variables:
CERTBOT_EMAIL: Set to [email protected].
Volumes:
nginx_secrets:/etc/letsencrypt (External volume for SSL certificates).
/data/nginx/user_conf.d:/etc/nginx/user_conf.d (Mapping of user Nginx configurations).

Application Update Instructions¶

To update the HestiaCP application, follow the procedure corresponding to your installation method:

If using Docker for the proxy:

cd /root/nginx && docker compose pull && docker compose up -d

For the main HestiaCP panel: Follow the official update procedures provided by the HestiaCP documentation, typically involving re-running the installation script or using the built-in v-update commands within the Hestia environment.

Available ports for connection¶

Port	Service
8083	HestiaCP Management Panel (Internal/Direct)
443	Secure Web Traffic (via Nginx Proxy)