Getting started

This is the whole journey on one page: from a bare server to your first app running live over HTTPS. Work through it top to bottom. Most people are done in about fifteen minutes.

Here's the shape of it:

  1. Get a server
  2. Point a domain at it (optional, but it's how you get HTTPS)
  3. Create an SSH key (optional — the next step can make one for you)
  4. Harden the server
  5. Install Orbita
  6. Create your admin account
  7. Deploy your first app

Steps 1–3 are one-time prep. If you already have a server, a domain, and a key, skip to Step 4.

You don't need Grit, Go, or the CLI

Orbita is a standalone platform. Everything below happens over SSH and in your browser. The optional orbita CLI is covered at the end — it's a convenience, never a requirement.

Step 1 — Get a server

Orbita runs on a VPS: a small Linux server you rent by the month. You want a fresh Ubuntu 22.04 or 24.04 box with at least 2 GB of RAM (4 GB is comfortable — builds are the hungry part), 30 GB of disk, a public IP, and root access.

Any of these providers work well; a 2 GB box is roughly $4–7 a month:

  • Contabo — the most RAM for the money, good when you'll run several apps on one box.
  • Hetzner — fast, reliable, cheap; the community favourite for self-hosting.
  • DigitalOcean — polished dashboard, one-click Ubuntu droplets, endless tutorials.
  • Vultr — many regions worldwide, so you can host close to your users.

When you create it, choose the Ubuntu 24.04 (LTS) image and a plan with 2 GB RAM or more. If the provider asks whether to use an SSH key or a password, either is fine.

Write these down before you go further

The moment the server exists, save its IP address (e.g. 203.0.113.10) and either the root password the provider gave you or the SSH key you created it with. You'll paste the IP into the very first command, and you can't proceed without the password or key.

Use a fresh box

Orbita's proxy needs to own ports 80 and 443. If something else already serves websites on this server (nginx, Apache, another panel), the installer will stop and remove it. Don't run this on a box that's already in production.

Step 2 — Point a domain at it

This step is optional. Without a domain you'll reach Orbita at http://YOUR_IP:8080 with no encryption — fine for a quick trial. With a domain you get real HTTPS certificates, issued free and automatically. It's worth the five minutes.

Buy a domain from Cloudflare (domains at cost, and the simplest DNS to manage), Namecheap, Porkbun, or any registrar — they all work.

You control Orbita on one subdomain, and each app you deploy gets its own. In your registrar's DNS panel, create an A record for each name, all pointing at your server's IP:

DNS records (at your registrar)
Type   Name          Value            Proxy
A      orbita        203.0.113.10     DNS only
A      shop          203.0.113.10     DNS only
A      api.shop      203.0.113.10     DNS only
A      admin.shop    203.0.113.10     DNS only

orbita is your dashboard. shop, api.shop, admin.shop are an example app — name them however you like. If you'll deploy lots of apps, a single wildcard record (* → your IP) covers every subdomain at once.

Cloudflare users: turn the proxy off

Set each record to DNS only (the grey cloud), not Proxied (orange). Orbita fetches the Let's Encrypt certificate itself, and the orange-cloud proxy gets in the way of that first handshake. You can switch it back on later.

DNS can take a few minutes to propagate. Confirm it points at your server before installing — certificates can't be issued until it resolves:

Local terminal (your PC)
bash
dig orbita.example.com +short

That must print your server's IP.

Step 3 — Create an SSH key

An SSH key is a passwordless, far more secure way to log into a server. This step is optional — the hardening in Step 4 can generate a key for you if you skip it — but making your own takes seconds. Check whether you already have one:

Local terminal (your PC)
bash
cat ~/.ssh/id_ed25519.pub

If that prints a line starting with ssh-ed25519, you're set. If it says "No such file", create one:

Local terminal (your PC)
bash
ssh-keygen -t ed25519 -C "you@example.com"

Press Enter through the prompts. You now have two files: id_ed25519 (your private key — never share it) and id_ed25519.pub (your public key — safe to paste on servers).

The private key is your identity

Anyone holding your private key can log into your servers. Never paste it into a website, a chat, or a config file. Whenever a step asks for "your key", it means the .pub one.

Step 4 — Harden the server

Never skip this. A fresh VPS with root SSH open is a target within minutes of coming online. Hardening creates a proper user, locks the box down, and scores it.

Log in as root:

Local terminal (your PC)
bash
ssh root@YOUR_SERVER_IP
From here to the end of Step 5, you're on the server

Every command below runs inside that SSH session — look for the amber “Server terminal” label.

Download the hardening script and run it:

Server terminal (SSH)
bash
curl -sSL https://raw.githubusercontent.com/MUKE-coder/vps-harden/main/vps-harden.sh -o vps-harden.sh
chmod +x vps-harden.sh
sudo ./vps-harden.sh --no-dokploy

It asks a few plain questions:

  • A username for your everyday account — type deploy.
  • An SSH port — press Enter to keep the default.
  • Your SSH key — if you made one in Step 3, paste the public line; if you didn't, leave it blank and press Enter and the script generates one for you and tells you where it saved it.
  • A password for the account — leave it blank and the script generates a strong one and prints it once at the end. Save that password.

When it finishes you have a deploy user with its own password and passwordless sudo, your key installed, root and password SSH logins disabled, a firewall (UFW + ufw-docker), Fail2ban, kernel hardening, and a 0–100 security score.

Two credentials, two jobs

The deploy account has both a key and a password — on purpose:

  • The SSH key is how you log in day to day. SSH is key-only; the password is not accepted over SSH.
  • The password is your recovery route. If you ever lose the key, you can still log in through your provider's web console with it, then add a new key. Without a password that door is shut and you'd need the provider's rescue mode.

sudo is passwordless so the installer and the optional CLI can run unattended — the account's own login stays protected by the key.

Save the password, and confirm you can still log in before you disconnect

This disables root SSH. When the script finishes it prints the deploy password — copy it somewhere safe. Then open a second terminal and check that ssh deploy@YOUR_SERVER_IP works before you close the first one. If the script generated an SSH key for you, save that too — it's your day-to-day way in.

--no-dokploy matters: the script can also install Dokploy, and Orbita replaces Dokploy. Running both would fight over ports 80 and 443.

Step 5 — Install Orbita

The installer brings everything with it — Docker, Swarm, PostgreSQL, Redis, and Traefik — so there's nothing to set up first. Pick the command that matches what you did in Step 2:

Server terminal (SSH)
bash
curl -sSL https://raw.githubusercontent.com/MUKE-coder/orbita/main/install.sh \
  | sudo ORBITA_DOMAIN=orbita.example.com ORBITA_ACME_EMAIL=you@example.com bash -s -- --yes

Traefik requests a Let's Encrypt certificate the first time your domain is visited.

In order, the installer installs Docker and starts Swarm, checks ports 80/443/8080, generates secrets into /opt/orbita/.env, pulls the Orbita image, starts all four services, opens the firewall for the ports it needs, and waits for a healthy /health before printing your dashboard URL.

Back up /opt/orbita/.env

That file holds ENCRYPTION_MASTER_KEY, from which every organisation's encryption key is derived. If you lose it, every stored secret is unrecoverable. Copy it somewhere safe before you put real data in.

Check that everything is up:

Server terminal (SSH)
bash
curl -s http://localhost:8080/health
cd /opt/orbita && sudo docker compose ps

You want {"status":"ok", ...} and all of orbita, orbita-postgres, orbita-redis and orbita-traefik showing Up. (The deploy user reaches Docker through sudo — it's deliberately not in the docker group, which is root-equivalent.)

Step 6 — Create your admin account

Open the dashboard in your browser:

  • With a domain: https://orbita.example.com
  • IP only: http://YOUR_SERVER_IP:8080

Register the first user right away. That account becomes the super-admin. Then create your first organisation (your workspace for apps, databases, and domains).

The first account owns the server

Whoever registers first becomes super-admin — so do it immediately, before anyone else finds the URL. Once that account exists, public sign-up closes automatically: everyone after joins by invitation, or through an account you create for them. See Using the dashboard.

Step 7 — Deploy your first app

Inside the dashboard the hierarchy is organisation → project → app. Create an organisation, then a project, then Create App from one of two sources:

A Docker image

The fastest way to see the platform work end to end — anything on Docker Hub or GHCR:

Orbita dashboard
Create App → Source: Docker Image
  Image: nginx:alpine     Port: 80
→ Create

A Git repository

Connect GitHub once under Settings → Git Connections (a token with repo + admin:repo_hook), then create the app and choose a build method:

Orbita dashboard
Create App → Source: Git Repository
  Pick the connection, repo + branch
  Build method:
    • Dockerfile — builds the Dockerfile in your repo
    • Nixpacks   — auto-detects the language, no Dockerfile needed
→ Create

Nixpacks builds Laravel, Django, Rails, Node, Go, static sites and more with no Dockerfile — Orbita detects the language for you. Dockerfile builds the one in your repo. Either way Orbita registers a webhook, so every future git push redeploys.

A Docker Compose stack

For an app that's several services at once (web + worker + queue), choose Source: Docker Compose:

Orbita dashboard
Create App → Source: Docker Compose
  Compose file: from your Git repo, or pasted inline
  Web service:  the service name that serves HTTP (e.g. web)
  Port:         the port that service listens on (e.g. 3000)
→ Create

Orbita deploys the whole file to Docker Swarm as a stack. Your web service is the one domains route to; every other service stays private to the stack, reachable by its compose service name just like on your laptop.

Your environment variables reach every service in the stack, so workers get DATABASE_URL too.

Two things to know about Compose

Services that use build: only work when the compose file comes from a Git repo — a pasted file has no source tree to build. And rollback isn't available for Compose apps, because a compose deploy has no single image to roll back to; redeploy the previous commit instead.

Then add a domain, env vars, and a database

From the app's tabs: Domains to attach a hostname (point its A record at the server first); Environment for variables (mark secrets — encrypted at rest). Databases are created at the org level under Databases → Create (Postgres / Redis / MinIO), then wired in via an env var.

The full walkthrough — every screen and tab, from register to rollback and inviting your team — is in Using the dashboard.

Prefer the terminal? The CLI

Everything above works without installing anything locally. If you'd rather drive it from your machine, the optional orbita CLI offers two entry points:

  • orbita init provisions a fresh server in one command — it runs the hardening and install from Steps 4–5 for you, then creates your admin login and registers the host.
  • orbita login https://orbita.example.com connects the CLI to a server you already installed (the case above), so orbita deploy can ship to it.

See the CLI reference to install it and for every command and flag. Grit apps in particular get a zero-config deploy — see Deploying Grit apps.

Managing your install

Server terminal (SSH)
bash
cd /opt/orbita
sudo docker compose pull orbita
sudo docker compose up -d orbita

Migrations run automatically on startup.

Where to go next

ArchitectureUsing the dashboard