# Installing, step by step

The whole installation is done by one command, `./draften install`, run in
the unpacked bundle. Here is the procedure from an empty server to the first
sign-in. What an installation contains and what lies where is described in
[Installing on your own server](/en/admin/self-hosting).

## Step 1: Prepare the server

- x86-64 with Linux (a Synology or another NAS with Docker works too),
- Docker Engine 24 or newer with the compose plugin — check with
  `docker compose version`,
- 4 GB of memory and 20 GB of disk space,
- the tools `tar`, `base64` and `sha256sum` (or `shasum`), which nearly every
  system has.

The server needs no internet for the installation: the bundle brings all the
images.

## Step 2: Check that the bundle is from us

For every release bundle `draften-<version>.tar` we publish its checksum.
Compute it and compare:

```
sha256sum draften-<version>.tar
```

Every later update the installation checks by itself against our keys. The
first installation has nothing to compare with, though — this is its check.
If the checksums differ, do not install the bundle and get in touch with us.

## Step 3: Unpack the bundle and run the installer

Choose the directory the installation will live in, unpack the bundle into it
and run the installer:

```
mkdir /srv/draften
tar -xf draften-<version>.tar -C /srv/draften
cd /srv/draften
./draften install
```

The installer loads the images, checks the bundle and asks for what it needs.

## Step 4: Answer the installer's questions

- **The address** people open draften at, such as `https://draften.firma.cz`.
  It must be the address they really use — the redirect addresses for signing
  in with Microsoft and Google are built from it.
- **The organisation** and its **short name** (lowercase letters, digits,
  hyphens).
- **The first administrator**: e-mail, name and language (`cs` or `en`). They
  become the organisation's owner and the operator of the whole installation.
- **The updater** (yes / no) — a service that lets you update, change the
  number of processes and replace the encryption key from the web interface.
  It has access to Docker, which means root rights on this machine. Without
  it, everything works from the command line.
- **The HTTPS certificate** — the certificate file and its key (PEM), if HTTPS
  is to end right in draften. Leave it empty when a reverse proxy or a tunnel
  in front of draften takes care of HTTPS (see step 7).

Every answer can also be given right in the command, so you can script the
installation; `./draften help` lists the options. For example:

```
./draften install --url https://draften.firma.cz --org "Firma Ltd" \
  --admin-email jan@firma.cz --admin-name "Jan Novák" --locale cs --updater yes
```

## Step 5: Keep a copy of `.env` off the server

The installer writes the settings and secrets into the `.env` file in the
installation directory. **Copy it — at least the `MASTER_KEY` value — to a
safe place off the server.** This key encrypts the mailbox access, the model
keys and the passwords for sending mail. Without it nobody can read them, not
even from a backup — and we do not have it.

## Step 6: Set your password and sign in

At the end the installer prints a link for setting the first administrator's
password. Open it in a browser, set the password and you are signed in. The
link works once and is valid for 7 days. What the password page looks like is
shown in the guide [Signing in](/en/signing-in).

!> Only the installer prints the link. Do not copy it anywhere or forward it —
whoever has it sets the administrator's password.

## Step 7: Publish the address

Depending on what you chose in step 4:

- **With a certificate**, draften itself listens on port 443 and redirects
  from port 80 to HTTPS. The address only needs to lead to this server in DNS.
- **Without a certificate**, draften listens on `127.0.0.1:8085` and your
  reverse proxy or tunnel in front of it ends HTTPS. When the proxy runs on
  another machine, set `WEB_BIND=0.0.0.0:8085` in `.env`.
- **With a Cloudflare Tunnel**, no open port is needed: put the tunnel's token
  into `.env` (`CLOUDFLARE_TUNNEL_TOKEN`), add `tunnel` to `COMPOSE_PROFILES`
  (say `COMPOSE_PROFILES=updater,tunnel`) and run `docker compose up -d`. In
  Cloudflare, point the tunnel at `http://127.0.0.1:8085`.

A certificate can be added later too:

```
./draften certificate cert.pem key.pem --url https://draften.firma.cz
```

## Step 8: Upload the licence

We send the licence as a file `licence-<number>.json`. In the interface, open
**Installation → Installation**, choose the file in the **Licence** card at
the bottom and upload it. Until the installation has a licence, the assistants
process no mail and no mailbox or assistant can be created. More in
[The licence](/en/admin/licence).

## Step 9: Set the default keys and outgoing mail

On the same **Installation** page, set the **Default API keys** for the models
and the **Default outgoing mail** (where invitations and password links come
from). They apply to every organisation that does not set its own. Details:
[Model API keys](/en/admin/api-keys) and [Outgoing mail](/en/admin/outgoing-mail).

## Step 10: Connect a mailbox and set up an assistant

From here you carry on as on any other installation:

1. [Add and connect a mailbox](/en/admin/adding-a-mailbox).
2. [Set up an assistant with the wizard](/en/new-assistant).
3. Invite more people — [People and roles](/en/admin/people-and-roles).

## Step 11: Check that everything runs

```
./draften status
```

prints the version, the health of the web and the workers, the HTTPS status
and the database dumps. In the interface, the **Operations** page shows
whether the workers check in — see [Operations and capacity](/en/admin/operations).

## Next

- [Updating with the updater](/en/admin/updating-with-the-updater) — a new
  version with one button,
- [Updating from the command line](/en/admin/updating),
- [Backup and restore](/en/admin/backup-and-restore),
- [Troubleshooting](/en/admin/troubleshooting).