Installation

curl -fsSL https://deplo.build/install.sh | bash

Already running Dokploy or Coolify?

The installer offers to take that machine over instead: it brings your projects across, then takes ports 80, 443 and 3000 from the old panel and inherits its certificates. Answer no and nothing is installed. See Take over your VPS.

What you need

Create your account

The installer prints a setup link at the end, next to the dashboard address:

Set up   https://deplo.example.com/setup?key=a3f9c1d84b7e2065

That link is the only way to create the first account. Without it the panel shows This instance isn't set up yet and nothing can be claimed - a fresh install answers on a public address whose name reaches certificate transparency logs within seconds, so the first account has to belong to whoever ran the installer rather than to whoever arrives first.

The link stops working on its own the moment the account exists. From then on the address goes to the sign-in page, and the key means nothing.

Open it. A fresh install starts completely empty, and the link opens the setup screen, Welcome to Deplo. It runs once: a workspace name, a username (lowercase letters, numbers, - and _), a display name, an admin email and a password, checked for length and character mix and against the Have I Been Pwned breach list. Click Create workspace to finish. That account is the instance owner: the tier above instance admin, and the only one that can hand the instance to somebody else later.

How it works

The installer is a shell script served from the repository. It is idempotent: secrets are generated once into /opt/deplo/.env, so running it again updates the containers in place and never rotates anything. If that file already exists, the script switches itself to update mode.

Everything it writes lands in /opt/deplo (secrets, the compose file, the Traefik stack, build staging, issued certificates), see Ports, networks, files for the full layout on this host and on every server it later enrolls.

Three containers come up:

• postgres:16-alpine on an internal network, not published to the host.
• ghcr.io/deplocloud/deplo, publishing port 3000 on 127.0.0.1 only: a panel on an open port is a login page on the internet with no TLS in front of it, so the dashboard is never reachable at <server-ip>:3000, only through Traefik. If the proxy itself is what broke, the way in is an SSH tunnel: ssh -L 3000:localhost:3000 root@your-server, then open http://localhost:3000.
• traefik:v3.7, holding 80 and 443, and serving the dashboard over HTTPS.

Neither Traefik nor the control plane ever gets the Docker socket. See How Deplo works for why.

What the installer changes on the host

Update it later

Re-run the same command. It pulls the newer image and restarts the stack, and your secrets stay exactly as they were. Pin a version with DEPLO_VERSION=0.4.1 in front of the command, or leave it to take latest.

The dashboard also checks for releases on its own and shows an update banner. See Upgrade for the full procedure, including the server agents, which version on their own clock.

Run it with Compose instead

docker-compose.yml in the repository runs the control plane and its Postgres behind Traefik. It's a readable, hand-editable starting point, not a copy of what the installer writes: the installer routes the panel through Traefik's file provider rather than container labels, precisely so the panel's own route can be changed from the panel later.

docker network create deplo
export DEPLO_DOMAIN=deplo.example.com   # required: it is the only address it serves
export DEPLO_SECRET=$(openssl rand -base64 48)
export DEPLO_DB_PASSWORD=$(openssl rand -base64 24)
export DEPLO_SETUP_KEY=$(openssl rand -hex 8)   # then open /setup?key=<it>
docker compose up -d

Going this way, you enroll the host as a server yourself from Settings -> Servers, exactly like any other machine.

If it does not work

See also