Complete every item before running setup-server2-full.
psa. cert; the setup script obtains certs for the remaining four domains.ssh -t with a real PTY. Output is streamed live. Do not close the terminal during install.xzopia with passwordless sudo:echo 'xzopia ALL=(ALL) NOPASSWD: ALL' | sudo tee /etc/sudoers.d/xzopia
sudo chmod 440 /etc/sudoers.d/xzopia
authorized_keysssh-keygen -R 109.228.38.65All subdomains must resolve before the setup script runs. certbot uses HTTP-01 challenge and will fail if DNS is wrong.
psa.<base-domain> → 109.228.38.65 (ITFlow — certbot runs during installer)vault.<base-domain> → 109.228.38.65 (Vaultwarden)kb.<base-domain> → 109.228.38.65 (Wiki.js)docs.<base-domain> → 109.228.38.65 (BookStack)portal.<base-domain> → 109.228.38.65 (SecureAgent Portal)Verify:
dig +short psa.<base-domain> vault.<base-domain> kb.<base-domain> docs.<base-domain> portal.<base-domain>
ssh -i ~/.ssh/xzopia_server1 xzopia@109.228.38.65 "echo ok"
ssh -i ~/.ssh/xzopia_server1 xzopia@109.228.38.65 "sudo id"
# Should print: uid=0(root) ...
cd ~/xzopia-deploy
npm run dev -- setup-server2-full \
--email simon@xzopia.com \
--base-domain xzopiasecure.com \
-i ~/.ssh/xzopia_server1 \
--port 22
Passwords are saved to ~/.xzopia-deploy/server2-passwords.env (mode 600).
Subsequent runs reuse the same passwords — do not delete this file while the stack is live.
Run from a real terminal (e.g. WSL) so the PTY is available. The ! prefix in Claude Code works:
! cd ~/xzopia-deploy && npm run dev -- setup-server2-full --email simon@xzopia.com --base-domain xzopiasecure.com -i ~/.ssh/xzopia_server1 --port 22
After the script completes the CLI automatically audits apache2, mariadb, Docker containers, and HTTPS reachability — and exits non-zero if any check fails.
https://psa.xzopiasecure.comhttps://vault.xzopiasecure.com/admin (password: VAULTWARDEN_ADMIN_PASSWORD in passwords file)https://kb.xzopiasecure.com/opt/xzopia/server2/.env has mode 600certbot certificates shows 5 valid certs