Deployment Overview of HestiaCP on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the server must meet the following requirements:

Operating System: Ubuntu or Debian.
Privileges: Root access or sudo privileges are required for the installation process.
Network Configuration:
TCP Port 8083 must be open for the HestiaCP control panel.
TCP Port 443 is used for external HTTPS traffic via the Nginx proxy.
System Optimizations: BBR (Bottleneck Bandwidth and Round-trip propagation time) congestion control and fq queuing discipline are enabled to optimize network performance.

The management interface is accessible via a specific subdomain based on the server ID.

Parameter	Value
Prefix	`hestiacp`
Domain	`hostkey.in`
Full template	`hestiacp{Server_ID_from_Invapi}.hostkey.in`

The following directories are used for configuration and certificate management:

/root/nginx: Contains the Docker Compose deployment files for the Nginx proxy.
/data/nginx/user_conf.d: Stores custom Nginx configuration files.
/data/nginx/nginx-certbot.env: Environment file containing Certbot settings.
/etc/letsencrypt: Volume used by the Nginx container to store SSL certificates.

The installation follows a multi-step procedure involving system preparation and script execution:

System Preparation: The OS is updated via apt upgrade, and essential utilities such as curl, wget, gnupg, ca-certificates, and dnsutils are installed.
Script Acquisition: The official HestiaCP installation scripts (hst-install-ubuntu.sh for Ubuntu or hst-install-debian.sh for Debian) are downloaded from the official repository to /root/.
Core Installation: An automated installation script is executed with the following parameters:
Hostname: Set according to the template hestiacp{Server_ID_from_Invapi}.hostkey.in.
Port: Configured to 8083.
User: The default admin user is created (pre-existing admin users are removed prior to installation).
Services Included: Apache, PHP-FPM, VSFTPD, Named, MySQL, Exim, Dovecot, ClamAV, SpamAssassin, IPTables, Fail2Ban, and the API.
Proxy Setup: A Docker-based Nginx container is deployed to handle SSL termination via Certbot.

Security is managed through several layers:

Firewall: iptables is installed and configured as part of the HestiaCP suite.
Intrusion Prevention: fail2ban is enabled and configured to monitor authentication logs (/var/log/auth.log) to prevent brute-force attacks.
System Logging: rsyslog is ensured to be running to provide necessary log data for security monitoring.

HestiaCP installs and manages its own database environment:

The deployment utilizes a Docker container to manage SSL certificates and Nginx proxying.

Nginx Proxy Container

Image: jonasal/nginx-certbot:latest
Ports: Uses network_mode: host.
Volumes:
nginx_secrets:/etc/letsencrypt (External volume for SSL certificates)
/data/nginx/user_conf.d:/etc/nginx/user_conf.d
Environment Variables: Managed via an external .env file located at /data/nginx/nginx-certbot.env.
Restart Policy: unless-stopped

To update the main HestiaCP application, follow these steps:

Log in to the server via SSH.
Run the system package manager updates and upgrade the installed packages:
```
apt update && apt upgrade -y
```
Follow any specific prompts provided by the HestiaCP management tools if applicable.

Service	Port	Protocol
HestiaCP Panel (Internal)	`8083`	TCP
HTTPS Proxy (External)	`443`	TCP

The core services are managed via systemd. To manage the Nginx proxy container, use:

2026-11-11