Installing Nukeflow

One command on a fresh server. Ten minutes, most of it spent downloading.

Before you start

Machine	Ubuntu 22.04+ or Debian 12+, amd64 or arm64. Other distributions usually work but are not tested.
Memory	2 GB minimum. 4 GB if you want Forgejo (Git) on the same server.
Disk	20 GB or more — images, the database and local backups.
Domain	A name pointing at the server, for example `work.example.com`. Needed before TLS can be issued.
Ports	80 and 443 free, unless you already run a reverse proxy — see below.

Install

curl -fsSL https://get.nukeflow.dev | sudo bash

Run it as root. It checks the machine, installs Docker if it is missing, downloads the current stable release, verifies its SHA-256 before unpacking anything, and then asks you a handful of questions.

Answer everything up front and it will not ask at all:

curl -fsSL https://get.nukeflow.dev | sudo bash -s -- \
  --domain work.example.com --email [email protected] --yes

What it asks

`--domain`	Where Nukeflow will answer. The certificate is issued for this name.
`--email`	Your administrator account, and the address Let's Encrypt writes to.
`--expose`	How the outside reaches it: `acme` (default, Nukeflow gets its own certificate), `cloudflare`, `tunnel` (Cloudflare Tunnel, no open ports), `external` (your own nginx or Traefik terminates TLS), `sslip` (no domain yet), `internal` (LAN only).
`--git`	`subdomain` runs Forgejo at `git.example.com`, `path` puts it under `/git`, `github` connects your existing GitHub, `off` leaves Git out.
`--registry`	Where images come from. The default is `registry.nukeflow.dev/nukeflow`.
`--version`	`stable` (default), `beta`, or an exact `vX.Y.Z`.

sudo bash -s -- --help lists every flag.

Already running a web server?

If nginx, Traefik or another proxy already owns ports 80 and 443, install with --expose external. Nukeflow then listens in plain HTTP on 127.0.0.1:8080 and your proxy forwards to it. Your proxy has to keep the Host header, pass WebSocket upgrades, and not cap request bodies — Git pushes and file uploads go through it.

Afterwards

The installer leaves a nukeflow command on the server:

`nukeflow status`	What is running, and whether the application answers.
`nukeflow upgrade`	Move to the current stable release. `nukeflow upgrade v1.2.3` for a specific one.
`nukeflow rollback`	Back to the previous release, including the database.
`nukeflow backup now`	A backup on demand. They also run on a schedule.
`nukeflow doctor`	Checks DNS, certificates, disk, mail and the things that usually break.
`nukeflow configure`	Change the domain, the Git mode or how TLS is handled, after the fact.
`nukeflow diagnostics`	A redacted archive to attach to a support request.

Everything lives in /opt/nukeflow. The secrets are in /opt/nukeflow/.env, generated on your machine and never transmitted. Losing that file means losing the vault and the database — it belongs in your password manager on day one.

Installing without internet access

Download the bundle and its checksums from https://dl.nukeflow.dev/releases/<version>/ on a machine that has access, carry them over, and run the installer with --bundle. The images have to be carried the same way, with docker save and docker load.