Install cyantula

What you need before you start

A machine. One of these two. The release image is amd64 only.

• A Proxmox VE host where you can run commands as root. The script creates a Debian 12 container for you. Its defaults are 4 cores, 8 GB memory and 40 GB disk. It also defaults to bridge vmbr0, an address from DHCP, and a privileged container with nesting on. Every default has a flag. bash proxmox.sh --help lists them.
• A Debian or Ubuntu machine where you can use sudo. Docker is installed for you if it is missing. The Docker Compose plugin has to be available.

The machine needs to reach github.com to download the release.

For real use

You need a domain for the portal and a wildcard DNS record for the apps, both pointing at the machine (or at a Cloudflare tunnel in front of it). Apps get a name under that domain, for example crm.apps.example.com when the portal is apps.example.com.

You need HTTPS before the first login (own certificates, Cloudflare tunnel, or a reverse proxy in front of 8080). The setup wizard itself opens on plain HTTP, but the sign-in cookie only travels over HTTPS. cyantula can answer on ports 80 and 443 with certificates you upload. It can ask Let's Encrypt for the portal name, not for the wildcard. It can also set up a Cloudflare tunnel when you give it an API token. A reverse proxy such as Caddy in front of port 8080 works too.

You need a way to sign in. Either internal accounts (invite-only, a password plus an authenticator app) or a Google OAuth client with the Workspace domains that may sign in. After setup an admin can also add Microsoft Entra ID, other OpenID Connect providers or Smartschool under Admin, Sign-in providers.

Optional, and you can add them later

• A GitHub App, so cyantula can clone repositories, create a repository for a zip upload, open pull requests and install webhooks. The wizard has a Copy prompt button that hands the GitHub App setup to an AI with the GitHub CLI and a browser.
• An Anthropic API key. It powers the publishing conversation, the Ask cyantula chat, the AI analysis that writes a Dockerfile, autofix and the review of every commit. Without it you get the publish form instead of the conversation, and a heuristic instead of the AI analysis.
• Email (Resend, or your own SMTP server) and Slack. Without them, messages are only written to the log.

Install

Proxmox, one command

On the Proxmox host, as root. This creates a Debian 12 container (4 cores, 8 GB, 40 GB by default) and installs cyantula inside it.

bash -c "$(curl -fsSL https://github.com/kobozo/cyantula-releases/releases/latest/download/proxmox.sh)"

It finds a Debian 12 template, creates and starts the container, installs cyantula inside it, and prints a link that already carries the one-time setup token. On Proxmox, enter the container with pct enter <id> before the later commands.

Any Debian or Ubuntu machine

curl -fsSL https://github.com/kobozo/cyantula-releases/releases/latest/download/install.sh | sudo bash

What it does, in order: installs curl, zstd and openssl, installs Docker if it is missing, downloads the cyantula command line tool and refuses it unless it is signed by the release key, writes a small machine-only settings file in /opt/cyantula, runs the first cyantula update, switches on a timer that checks for a new release every 10 minutes, and prints the status and the setup token.

Ports: if 80 and 443 are free, the installer publishes them so the machine can terminate TLS itself. If they are busy, only 8080 is published and you put TLS in front. Force it with --ports direct or --ports proxy, or change it later with cyantula configure --ports direct or cyantula configure --ports proxy.

Check that it runs

cyantula status
curl -s localhost:8080/healthz
cyantula setup-token

cyantula status shows the installed version, channel, timer and health. cyantula setup-token prints the one-time setup token again. You need it in the next step, the setup wizard.