Deploy

Install on Debian or an LXC

deploy/lxc.sh sets up CERMM on a fresh Debian 13 (or 12) machine, VM or LXC container, and runs it under systemd. Running it again after a git pull updates it.

Install

As root:

apt-get update && apt-get install -y git
git clone https://git.klab.gg/xvoltzz/CERMM.git /opt/cermm && cd /opt/cermm
sh deploy/lxc.sh

What it does

1. Installs a few packages: curl, ca-certificates, xz-utils, git and libatomic1 (Node needs it).
2. Downloads Node 26 into /opt/node and Go into /opt/go, checking each against its published SHA-256. Skipped when the right version is already there.
3. Builds the web app (npm ci, npm run build) and the agents for every system (agent/build.sh, into agent/dist/; the server hands these out).
4. Makes a cermm system user, and /var/lib/cermm for the data (mode 700).
5. Writes /etc/systemd/system/cermm.service and, the first time only, /etc/default/cermm for your settings. Enables and starts the service.
6. Prints the address, the certificate's SHA-256 fingerprint and the setup code.

The service runs as cermm, can write only to /var/lib/cermm (ProtectSystem=strict, ProtectHome, PrivateTmp, NoNewPrivileges) and restarts if it stops.

Another port

The port is set when the service file is written:

CERMM_PORT=8443 sh deploy/lxc.sh

Other settings go in /etc/default/cermm (see Environment variables); the script doesn't overwrite that file once it exists.

In an LXC container on Proxmox

Make a Debian 13 container from the standard template and run the script inside it as root. Give the container a fixed address (a DHCP reservation or a static IP): agents keep the address they were installed with.

After it's running

• Open the address it printed and claim the first account.
• Logs: journalctl -u cermm -f.
• Restart after changing /etc/default/cermm: systemctl restart cermm.