Skip to main content
A single script installs Kuro, with one or two roles:
  • api: the API, its panel and the official prefabs;
  • node: the daemon that runs game servers (Add a node).
It checks every archive before installing it, and refuses an unverified binary (Verify what you install).

​
1. Pick a profile

With --full, for the api role:
  • system updates, then automatic security updates;
  • fail2ban against SSH login attempts;
  • ufw firewall: everything inbound is closed except SSH, 80 and 443 (the panel) and 8443 (nodes);
  • key-only SSH, if a key is already authorized for root or your user (otherwise SSH is left alone);
  • Docker, from Docker’s official repository;
  • Caddy, which serves the panel over HTTPS and gets the certificate on its own.
The script shows what it will do and asks for confirmation. To only look, without changing anything:

​
2. Download, read, run

The name given to --public-host must already point to the machine (DNS A or AAAA record): Caddy needs it for the certificate, and nodes need it to connect.
Or in one line, if you trust the source (--yes skips the confirmation):
get.kuroctl.com/api serves the script with the api role already chosen; get.kuroctl.com/install.sh serves it without a role, which you then pass (install.sh api).

​
Options

The script creates the kuro system user, writes the configuration to /etc/kuro/, creates the nodes’ private certificate authority and starts the kuro-api service.

​
3. Without --full: TLS and firewall

The API listens locally: a reverse proxy publishes it over HTTPS. With Caddy:
/etc/caddy/Caddyfile
Nodes connect to the API on port 8443/tcp (mTLS): open it in the firewall, from the Internet or only from your nodes. With --full, all of this is done. A Caddyfile you already edited is not overwritten: the script prints the block to add.

​
4. Create the first admin

The password is asked interactively, never passed as an argument. Two-step verification (TOTP) is required at first login. Then open https://panel.example.com and sign in.

​
Everything on one machine

The API and a node can share a machine. Give both roles and the game server port range:
The script creates the node on the API it just installed and enrolls it itself: no token or fingerprint to copy.

​
Next

Add a node

Enroll a machine to deploy your first servers.