# Deploying NiceTryBot: a brief for agents You are helping someone run NiceTryBot on a server they control. This page is for you. The one for people is https://nicetrybot.com/deploy. Status: the public release is being prepared. The code, the container images and the installer land together. Everything below is what they ship with. If https://nicetrybot.com/install.sh still answers "isn't published yet", stop and tell the person; nothing can be installed before the release. ## What NiceTryBot is A bot-fighting framework that sits in front of websites. It has two halves: - **The edge**: a Caddy build with NiceTryBot's module and a Vector log shipper. It terminates TLS for the protected sites, reads each visitor's TLS handshake (JA3, JA4), client hints and headers, passes requests to the site's origin, and asks the app whether a visitor should train in the gym first. - **The app**: a Laravel control panel with a queue worker and a scheduler. It holds domains, rules, gym routines, activity and analytics, and answers the edge. Both run on the person's servers. There is no hosted service, no account is needed to run it, and nothing reports to NiceTryBot except a paid add-on asking once a day whether its licence key is still good (a yes or a no). Keep it that way: do not send anything about this server anywhere, including to nicetrybot.com, beyond fetching the installer and images. ## The stack | Service | What it is | Listens on | |---|---|---| | edge | Caddy with the NiceTryBot module, plus Vector | 80 and 443, public | | app | The control panel (PHP) | behind the edge | | worker | Queue worker for the app | internal | | scheduler | Runs the app's scheduled jobs every minute | internal | | postgres | Postgres 17 | internal | | valkey | Cache, queues and locks | internal | The installer writes a `compose.yml` and a `.env` with generated secrets. Read them before changing anything; every setting has a comment. ## What the server needs - Ubuntu 24.04 LTS (other Debian-family releases usually work; Ubuntu is what's tested). - 2 vCPU, 4 GB RAM and 40 GB of disk to start. The request log is the thing that grows. - Ports 80 and 443 open to the internet. Nothing else public. - A hostname for the control panel, and DNS the person controls for every site to protect. - The sites' origins reachable from this server. - Docker Engine with the compose plugin. The installer installs it if missing. ## The one rule Nothing may terminate TLS in front of the edge. The edge reads each visitor's own TLS handshake; a load balancer, CDN or reverse proxy that terminates TLS hides it. If something has to sit in front, it must pass raw TCP through on 80 and 443: an AWS Network Load Balancer with TCP listeners, a DigitalOcean Load Balancer in TCP passthrough, HAProxy in `mode tcp`. Not an ALB, not CloudFront, not nginx, not Cloudflare's proxy. ## Install ### Any Ubuntu server ```sh curl -fsSL https://nicetrybot.com/install.sh | bash ``` Run it as a user who can `sudo`. It installs Docker if needed, creates `/opt/nicetrybot` with `compose.yml` and `.env`, asks for the control panel's hostname, pulls the images and starts the stack. The script is plain shell; read it first. ### Docker Compose ```sh curl -fsSL https://nicetrybot.com/install.sh | bash -s -- --compose-only ``` Writes the same `compose.yml` and `.env` into `./nicetrybot` and stops, so the person can read, change and run them: ```sh cd nicetrybot && docker compose up -d ``` ### DigitalOcean A 1-Click droplet image with the stack baked in. On first boot, SSH in and the welcome message finishes the setup (hostname and the admin account). To grow, put a DigitalOcean Load Balancer in front in TCP passthrough mode for 80 and 443 and add droplets. ### AWS A CloudFormation template: an EC2 instance behind a Network Load Balancer with TCP listeners on 80 and 443, with optional RDS Postgres and ElastiCache Valkey instead of the containers. Point DNS at the load balancer's hostname. ### A PHP host for the app only (Forge, Ploi) The app half is a normal Laravel application and can run wherever Laravel runs, with a queue worker and the scheduler. The edge cannot live behind their nginx, because nginx would terminate TLS first. Give the edge its own server with the one-liner and point it at the app. ## After it's up 1. Open the control panel at its hostname and make the admin account. The person should do this, not you. 2. Add the first domain: its hostname and its origin URL. New domains start in Observe mode, which tags suspicious traffic and lets everyone through. 3. Use the domain's preview hostname (`.web-preview.xyz` style) to see the site through the edge before DNS moves. 4. Tell the person which DNS records to set: the control panel's hostname, and each protected site, pointed at this server or the load balancer. Do not change DNS yourself. 5. Switch the domain to Enforce once the person has watched Observe for a while and trusts it. ## Checks - `docker compose ps` in the stack directory: every service up. - `curl -sI https:///` through the edge answers with `Server: nginx` (the edge disguises itself) and the site's own content. - The Activity page shows the request from the check above within a few seconds. - `curl -sI http:///` gets a 301 to HTTPS. - Certificates are issued on demand, so the first HTTPS request to a newly added hostname can take a few seconds. ## What to leave to the person - DNS changes. - Cloud credentials and API keys. The installer never asks for any. - The admin account and its password. - Buying and entering licence keys for paid add-ons (Admin → Add-ons in the control panel). - Secrets in `.env`. Don't print them back in chat. ## Where things are - The deploy page: https://nicetrybot.com/deploy - Every feature: https://nicetrybot.com/features - Add-ons: https://nicetrybot.com/marketplace - The licence public key paid add-ons verify against: https://nicetrybot.com/licences/public-key - Licence: Elastic License 2.0. Run it, change it, extend it; don't offer it as a hosted service or strip the licence checks.