Installing TAPPaaS¶
TAPPaaS installs as a set of interlinked foundation modules and platform services, built and configured to work together. The process is seven stages; each one tells you what it needs and what "done" looks like before you move on.
The seven stages¶
| # | Stage | You'll need | Done when |
|---|---|---|---|
| 1 | Hardware Selection | An honest look at your needs | Hardware sized by tier + options, on the bench |
| 2 | Preparation | Network, domain, credentials, branch | The preparation checklist is all ticked |
| 3 | Install Foundation | Stages 1 + 2 complete | Foundation installed on all nodes; network cut over; you can log in everywhere |
| 4 | Add an Environment (optional) | A running foundation | Each tenant/purpose has its own separated environment |
| 5 | Add a Satellite (optional) | A VPS, if you planned one | The satellite carries its roles (ingress / backup / VPN) |
| 6 | Add Stacks | A running foundation | The apps you chose are installed and reachable |
| 7 | Operate | — | Updates, backup and health checks running on schedule |
Stage 1 — Hardware Selection¶
Pick a size tier (Evaluation / Home / SMB / Scale-out), then toggle three capability options — local AI, local backup, local public IP — independently. The hardware selection guide walks the decision in four steps and gives per-tier sizing tables.
Done when: you know your tier, your options, and the machine(s) are in hand.
Stage 2 — Preparation¶
One concise checklist: network facts, domain + DNS API token, credentials, admin email — and the branch your system will track (stable vs main). See Preparation.
Done when: every box in Preparation is ticked.
Stage 3 — Install Foundation¶
The automated foundation install: the first Proxmox node plus one command chain that brings up the OPNsense firewall, the network cut-over (additive — the firewall becomes your gateway without dropping your session or moving cables) and the CICD mothership; additional nodes joining unattended; DNS/TLS setup (wildcard certificates via your DNS provider's API); and the remaining foundation modules (backup, identity, logging) with your organisation bootstrapped in the identity provider.
The authoritative, always-current procedure is Install Foundation — follow its steps top to bottom.
Done when: the install prints its "🎉 your TAPPaaS foundation is installed" summary, and you can reach the Proxmox UI, the firewall UI and the CICD mothership.
Stage 4 — Add an Environment (optional)¶
Run more than one world on the same platform: production next to family, tenants next to experiments — separated environments with network boundaries between them. See Add an Environment.
Done when: each environment exists with its own zones and domain.
Stage 5 — Add a Satellite (optional)¶
If you planned a satellite in stage 1 (public ingress without a public IP, off-site backup, admin VPN — see the hardware guide), enrol the VPS now via the satellite install.
Done when: the satellite carries its roles.
Stage 6 — Add Stacks¶
Install the workloads you chose in stage 1. First-party modules install with module-manager module add <module>; community module stores register once with site-manager repository add <repo> --branch <branch>, after which their modules install the same way.
| Stack | What you get |
|---|---|
| AI stack | Local AI: vLLM serving, LiteLLM gateway, OpenWebUI |
| Productivity stack | Nextcloud (n8n, Karakeep planned) |
| Home stack | Home Assistant (Jellyfin, Immich planned) |
| IoT stack | deCONZ Zigbee gateway |
Done when: each installed app answers on its URL and is known to the Module Manager.
Stage 7 — Operate¶
Hand over to day-to-day operation: the managers keep updating, backing up and health-checking the platform. That is Operate — bookmark it.