Quick start

Pick one path. Both install scripts are idempotent: already-installed components are skipped, and re-runs never overwrite configuration or data.

Prerequisites

A Linux server (containers) or a Windows machine (bare metal)
A DeepSeek API key

Linux server (containers, recommended)

mkdir -p /app && cd /app          # the current directory becomes the install directory
curl -fsSL https://raw.githubusercontent.com/litestartup-com/hellodac/v1.0.0/install.sh -o install.sh
bash install.sh                    # interactive: API key → password → domain → TLS mode

For unattended installs, preset the answers: DEEPSEEK_API_KEY=... APP_DOMAIN=... TLS_MODE=origin-ca bash install.sh.
Installing into your home directory is refused on purpose. Preview what the script would do with DRY_RUN=1.
Moving the install: move the whole directory, cd into it and re-run bash install.sh (idempotent — it re-pins workspace host paths), then docker compose up -d.

Windows (bare metal)

irm https://raw.githubusercontent.com/litestartup-com/hellodac/v1.0.0/install.ps1 -OutFile install.ps1; powershell -ExecutionPolicy Bypass -File .\install.ps1

The only input is your DeepSeek API key; preset DEEPSEEK_API_KEY=... for a fully unattended install. DRY_RUN=1 dry-runs, --yes skips confirmations.

Domain + HTTPS (optional)

Answer the domain question and pick the origin-ca TLS mode, then supply a certificate in one of three ways:

Place it ahead of time (recommended): ssl/cert.pem + ssl/key.pem in the install directory, press Enter at the prompt.
Paste the paths when prompted.
Unattended: SSL_CERT_SRC / SSL_KEY_SRC.

With Cloudflare, the certificate comes from SSL/TLS → Origin Server → Create Certificate. Port 80 redirects to 443, and secure cookies turn on automatically. For Let's Encrypt instead: run once with TLS_MODE=letsencrypt on port 80, then certbot --nginx -d your.domain on the host.

After installing

Open http://<server-ip> (Windows bare metal: http://127.0.0.1:8080), sign in, and change the password on first sign-in (the UI forces it). The initial password is the one you set during install, or the one printed once in the manager's boot log.

Upgrading

Bare metal: npm run update (backup → pull → build → health probe, automatic rollback on failure).
Containers: change MANAGER_VERSION in .env to the new tag, then docker compose up -d.
A node's DSH version: use the version dropdown on the node's row in /nodes.
Configuration migrates itself: an older manager.config.yaml is upgraded at startup (original kept as .pre-mig.bak) — upgrading never means editing config by hand.