Installing TAPPaaS¶

TAPPaaS installs as a set of interlinked foundation modules and platform services, built and configured to work together. The process is seven stages; each one tells you what it needs and what "done" looks like before you move on.

The seven stages¶

Stage 1 — Hardware Selection¶

Pick a size tier (Evaluation / Home / SMB / Scale-out), then toggle three capability options — local AI, local backup, local public IP — independently. The hardware selection guide walks the decision in four steps and gives per-tier sizing tables.

Done when: you know your tier, your options, and the machine(s) are in hand.

Stage 2 — Preparation¶

One concise checklist: network facts, domain + DNS API token, credentials, admin email — and the branch your system will track (stable vs main). See Preparation.

Done when: every box in Preparation is ticked.

Stage 3 — Install Foundation¶

The automated foundation install: the first Proxmox node plus one command chain that brings up the OPNsense firewall, the network cut-over (additive — the firewall becomes your gateway without dropping your session or moving cables) and the CICD mothership; additional nodes joining unattended; DNS/TLS setup (wildcard certificates via your DNS provider's API); and the remaining foundation modules (backup, identity, logging) with your organisation bootstrapped in the identity provider.

The authoritative, always-current procedure is Install Foundation — follow its steps top to bottom.

Done when: the install prints its "🎉 your TAPPaaS foundation is installed" summary, and you can reach the Proxmox UI, the firewall UI and the CICD mothership.

Compare the release signer¶

TAPPaaS releases on the stable and staging branches are tags signed by the TAPPaaS owners. The install checks that the release it clones is signed by one of the keys below, and records that release as the first one the site trusts; every later update must be signed by a key that release lists. The fingerprints below are the one thing you take on trust, so compare them with what the install prints:

TAPPaaS v2.4: signed by SHA256:… — compare it with the fingerprint in INSTALL.md

Check the same fingerprints on tappaas.org and in the release notes; if they differ anywhere, stop and ask before installing. What the site checks from then on, and how to read it: Verified updates. Until the keys are published TAPPaaS releases are unsigned and the install says so (TAPPaaS signs no releases yet). The main branch is never signed.

Stage 4 — Configure Environments (optional)¶

Run more than one world on the same platform: production next to family, tenants next to experiments — separated environments with network boundaries between them. See Configure Environments.

Done when: each environment exists with its own zones and domain.

Stage 5 — Add a Satellite (optional)¶

If you planned a satellite in stage 1 (public ingress without a public IP, off-site backup, admin VPN — see the hardware guide), enrol the VPS now via the satellite install.

Done when: the satellite carries its roles.

Stage 6 — Add Workloads¶

Install the workloads you chose in stage 1. First-party modules install with module-manager module add <module>; community module stores register once with site-manager repository add <repo> --branch <branch>, after which their modules install the same way. On a stable or staging branch, a repository that signs its releases is added with the release to trust first and its owner's key fingerprint — --introduction <tag> --signer SHA256:<fingerprint>, both from the repository's owner — and one that signs nothing with --unsigned.

Each stack's INSTALL.md lists its modules in install order, with the notes for that stack; each module's INSTALL.md says what to do by hand. What a stack is: its README.md.

Done when: each installed app answers on its URL and is known to the Module Manager.

Stage 7 — Operate¶

Hand over to day-to-day operation: the managers keep updating, backing up and health-checking the platform. That is Operate — bookmark it.