Add a server

From the dashboard: Servers → Add server. Or from the CLI: sproobo enroll <name> -y. Either way you get back a one-liner with a single-use enroll token baked in.

Run the one-liner as root

Paste it into an SSH session on the server:

SPROOBO_ENROLL_TOKEN='<your-token>' bash -c "$(curl -fsSL 'https://cp.sproobo.com/dl/bootstrap.sh')"

This runs the enroll bootstrap script end to end: Docker, the agent, the firewall baseline, the shared proxy, and enrollment.

Wait for the bootstrap to finish

The one-liner takes a couple of minutes to run — it installs Docker CE and the agent. Once the agent connects outbound over WSS/443, the server flips from enrolling to ready in the dashboard within seconds.

Create your app

From the dashboard's New app flow, or the CLI:

sproobo apps create my-app --server <serverId> --repo https://github.com/you/app --domain example.com -y

This wires up apex+www ingress and a certificate, then kicks off the first deploy.

Watch the first deploy stream live

The image builds off-box, the new container starts, passes the health gate, and the proxy switches traffic to it — the same blue-green path every later deploy uses.

Point DNS at the server

Add records for both the apex domain and www pointing at the server's IP — Sproobo's proxy config always expects both.

The certificate issues automatically

Once DNS resolves, the built-in ACME issuance picks it up and keeps it renewed — nothing to configure by hand.

Detect OS & arch

Confirms Debian-family or RHEL-family, amd64/arm64, root/sudo, and free disk space.

Detect port owners

Checks whether something already holds :80/:443 — used later to decide whether Sproobo starts its own proxy or steps aside for yours.

Install Docker

Docker CE, containerd, buildx, and the compose plugin, from each distro's official repo.

Configure the Docker daemon

Sets userland-proxy=false — required so the host firewall (the DOCKER-USER chain) can actually enforce rules on published container ports.

Set up the host

Creates the unprivileged sproobo system user (the bind-mount data owner) and the /var/lib/sproobo directory tree.

Install the agent

Downloads the checksum-verified agent binary for this host's architecture, installs the systemd unit, and stages the enroll token.

Firewall baseline

ufw (Debian-family) or firewalld (RHEL-family): allow 22/80/443, then default-deny everything else inbound. SSH is allowed before the default-deny is ever applied — it is never closed.

Network & proxy

Creates the internal sproobo-int Docker network and starts the shared Caddy proxy container — unless a foreign process already owns :80/:443, in which case it steps aside instead of fighting for the port.

Enroll

Enables and starts the agent service. It dials the control plane and completes enrollment with the staged token.