Installing AdminBolt

AdminBolt is installed with a single command that runs a non-interactive installer on a fresh server. This page describes the requirements, the install command, its options, what the installer does, and how to reach the panel for the first time.

Requirements

• Operating system: AlmaLinux 9 or Rocky Linux 9.
• Access: root (the installer must be run as root, for example with sudo).
• Port: TCP 8443 must be free. If it is already used by an existing bolt-nginx, the installer proceeds as a reinstall; if it is used by any other service, the installer stops.
• Commands: curl and ss must be available. Both are present by default on AlmaLinux 9 and Rocky Linux 9.
• RAM: 2 GB minimum, 4 GB recommended.
• CPU: 2 cores.
• Disk: 20 GB of available space.

Quick install

Run the following as root on a supported, freshly provisioned server:

curl -fsSL https://get.adminbolt.com/install.sh | bash

This command is non-interactive: it does not prompt you for a domain, email, nameservers, or service selection. It downloads the installer, installs the current AdminBolt release, and tees all output to /home/adminbolt-install-log.txt so you can review the full run afterward.

Options

The following options apply when you invoke the installer script directly rather than through the quick-install command:

• --email=<address> - activate a trial license for that address during the install. See Licensing at install time.
• --version=<PANEL_VERSION> - install a specific bolt-panel version. When omitted, the latest version from the repository is installed.
• --mariadb-version=<10.11|11.4> - the MariaDB series to install. When omitted, a new server gets MariaDB 11.4. See MariaDB version.
• --ssh-key=<public key|https URL> - add an SSH public key for root and turn SSH password login for root off once a sign-in with that key has been seen. See SSH key for root.
• --help, -h - print usage information.

Licensing at install time

AdminBolt needs a license to run. You decide at install time whether the installer asks for a trial on your behalf, or whether you activate a license yourself afterwards.

Pass your e-mail address to start a trial as part of the install:

sudo ./install.sh [email protected]

The trial is activated immediately and runs for 24 hours. AdminBolt also sends a confirmation message to that address; confirming your e-mail address through it extends the trial to the full period. Until the address is confirmed, the trial stays at 24 hours. The panel's License page (/admin/settings/license) shows the state of the trial and can resend the message.

Without --email, the install still completes, and the panel starts unlicensed. Activate a license whenever you are ready on the License page, either by requesting a trial there or by entering a license key you already hold.

Note: The installer checks the address before anything is installed and stops if it is not a well-formed e-mail address of the form [email protected]. Since panel 1.9.4 the error names what it does not accept: spaces, quotes ("), $, the backtick, ;, and control characters. An address it accepts is passed to the trial request exactly as you typed it. If a license is already configured on the server, the trial request is skipped.

MariaDB version

Since panel 1.9.4 a new server gets MariaDB 11.4. To install the previous long-term series instead, pass --mariadb-version:

sudo ./install.sh --mariadb-version=10.11

Series	Supported until
MariaDB 11.4 (the default)	2029-05
MariaDB 10.11	2028-02

Any other value stops the installer before anything is installed. Without the option, a server that already runs MariaDB, for example when you run the installer again, keeps the series it has. Servers installed with an earlier version keep their series when they are updated; the panel moves a server to a newer series only when you choose it under MariaDB server on MySQL Settings.

SSH key for root

Since panel 1.9.4, --ssh-key adds your SSH public key for root and, once it is proven to work, turns SSH password login for root off, so the server is not open to password guessing against root from its first minutes.

sudo ./install.sh --ssh-key="ssh-ed25519 AAAA... you@laptop"

The value is one public key in quotes, or an https:// address that returns public keys, one per line. The installer checks the key before anything is installed and stops when it is not a plain SSH public key. Keys root already has stay as they are.

Password login for root is turned off at the very end of the install, and only when every check passes:

1. The key is still among root's authorized keys, and the server's SSH settings let root sign in with it.
2. The key is not restricted, for example to one command, so that a sign-in with it opens a shell.
3. A root sign-in with that key is seen after the installer has set up SSH. When the installer runs in a terminal, it asks you to sign in with the key from a new terminal and waits up to 10 minutes; press Enter to skip. Without a terminal, for example when the install runs from cloud-init, no such sign-in can be seen.

When a check does not pass, password login for root stays as it was, and the installer prints the reason and the command that turns it off once you have signed in with the key. Only root is affected: other users, such as hosting accounts, keep their password login, and whether root may sign in over SSH at all stays under SSH Access. When password login for root is turned off, the installer prints how to allow it again.

While root can still sign in with a password, Health shows a warning.

What the installer does

The installer runs in three stages.

Stage 1 - pre-flight checks

Confirms that the script is running as root, that the operating system is AlmaLinux 9 or Rocky Linux 9, that the required commands are present, and that TCP port 8443 is free (or already held by an existing bolt-nginx).

Stage 2 - base setup and packages

1. Disables SELinux.
2. Enables the EPEL and CRB repositories, installs prerequisite packages, and installs acme.sh.
3. Adds the Bolt package repository and installs bolt-agent, bolt-nginx, bolt-php, and bolt-panel, then enables and starts bolt-nginx and bolt-php.

Stage 3 - post-install via bolt-cli

Requests a trial license when you passed --email, connects bolt-agent to the panel, and installs and configures the service stack: the nftables firewall, SSH, PowerDNS, MariaDB (11.4 unless --mariadb-version names another series), Postfix, Dovecot, Redis, Rspamd, mlmmj, PHP 8.4, Apache, vsftpd, and Fail2Ban. It also installs the integrated apps (Local API, File Manager, phpMyAdmin, Roundcube, Git, Metrics, and Adminer), their default profiles, the firewall, the default DNS-records template, and cron jobs. Finally, it generates the first-login SSO URL.

The default hostname, nameservers, and Contact Email

During the install, AdminBolt gives the server a free hostname under myboltip.com, built from its public IPv4 address with dashes in place of the dots. A server at 203.0.113.10, for example, gets 203-0-113-10.myboltip.com. The panel, mail, and FTP answer on that name before you have set up a domain of your own. A publicly trusted certificate for it is requested automatically during the install; until it is issued, or if the request fails, they use a temporary self-signed certificate, and your browser warns about it.

The installer sets three things from that name:

Setting	Starts as	Where you change it
Hostname	203-0-113-10.myboltip.com	Settings > General > General Settings, Hostname & SSL tab
Nameservers	ns1.203-0-113-10.myboltip.com and ns2.203-0-113-10.myboltip.com	Settings > DNS > DNS Settings, see Change Nameservers
Contact Email	[email protected]	Contact Email on the General tab of General Settings

When you move the server to a hostname of your own, change all three. A hostname change does not change the nameservers or Contact Email, and it switches off the admin@ mailbox the default Contact Email points to. See What keeps the myboltip.com name.

How myboltip.com names work

• A name of the form <ip-with-dashes>.myboltip.com resolves to the IPv4 address it is built from.
• The certificate for the default hostname is issued with a DNS check. While it is issued, a temporary TXT record, _acme-challenge.<ip-with-dashes>.myboltip.com, is published through AdminBolt's service so that the certificate authority can check it, and it is removed again shortly afterwards.

First login

When the installer finishes, it prints a one-time SSO URL. Open that URL to reach the admin panel at https://<server>:8443 without entering a password.

Since panel 1.9.4, the panel opened by the server's IP address, for example https://203.0.113.10:8443, shows a trusted certificate issued for that address. The panel orders it on its own within about an hour of the install. Until then, or when it cannot be issued, the address shows the hostname certificate and your browser warns about it. See Panel certificate for the server IP address.

To generate a fresh SSO URL later, run bolt-cli admin-sso-generate.

The panel asks two questions the first time you sign in and then hands you your logins. See First run for what to expect and what to keep.

Unattended installation

First access normally uses the one-time SSO URL described above. For fully unattended provisioning, where no operator reads the installer output, you can set the administrator password directly instead of relying on the SSO URL.

Run bolt-cli set-admin-password to set the password for the administrator account. The administrator login is always admin.

bolt-cli set-admin-password

Called without options, the command generates a strong 20-character password and prints it to stdout. The password is temporary: the panel requires you to change it at first sign-in.

To supply your own password instead, pass --password:

bolt-cli set-admin-password --password=<password>

Warning: A password passed with --password on the command line can be recorded in your shell history. Prefer the generated password, or clear the relevant history entry afterward.

Troubleshooting

If the installer stops before completing, check for one of these conditions and review the install log at /home/adminbolt-install-log.txt:

• Not run as root - the installer exits immediately. Re-run it as root, for example with sudo.
• Unsupported operating system - the installer supports AlmaLinux 9 and Rocky Linux 9 only. On any other distribution or version, it stops during the pre-flight checks.
• Missing curl - the installer requires curl and exits if it is not found. Install curl and run the installer again.
• Port 8443 already in use - if another service (anything other than an existing bolt-nginx) is listening on TCP 8443, the installer stops and prints the current listener. Free the port and run the installer again.
• Repository download failure - if the Bolt package repository cannot be downloaded, the installer stops. Confirm that the server has outbound internet access and that no firewall is blocking the download, then run the installer again.