---
title: "Installation"
description: "Install Harblet on a fresh Ubuntu server with one command."
canonical_url: "https://harblet.com/docs/getting-started/installation"
---
# Installation

> Install Harblet on a fresh Ubuntu server with one command.

## Requirements

- A **fresh server** with **Ubuntu 24.04 or 26.04** and root access. The install script stops if k3s is already installed.
- At least **2 CPUs and 4 GB of memory**.
- **Internet access** from the server.
- These ports open in the server's firewall:

<table>
<thead>
  <tr>
    <th>
      Port
    </th>
    
    <th>
      For
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      TCP 80 and 443
    </td>
    
    <td>
      Your services' domains, and Harblet's own domain later
    </td>
  </tr>
  
  <tr>
    <td>
      TCP 3000
    </td>
    
    <td>
      Harblet, until it has its own domain
    </td>
  </tr>
</tbody>
</table>

Harblet runs on x86_64 and arm64 servers.

<tip>

Most cloud providers offer Ubuntu 24.04 images. A small VPS with 2 CPUs and 4 GB is enough to start. Harblet and k3s take part of the memory, the rest is for your services, so pick a larger server if you plan to run many of them.

</tip>

## Install

Log in to the server and run:

```bash [Server]
curl -fsSL https://raw.githubusercontent.com/harblet/harblet/main/install.sh | sudo sh
```

The script installs [k3s](https://k3s.io) and Harblet. This takes a few minutes. When Harblet is ready, it prints its address:

```text
Harblet is ready. Open http://203.0.113.10:3000 to create the first account.
```

## Create the first account

Open the address in your browser. Harblet asks you to **Set up Harblet**: enter your name, email and a password of at least 8 characters, then click **Create account**.

This first account is an admin. Everyone else joins through an [invitation](https://harblet.com/docs/administration/team).

<warning>

Create the first account right after the install. Until then, anyone who opens the address can create it.

</warning>

## Servers behind NAT

Harblet accepts logins only at the address the script prints. The script uses the IPv4 address the server reaches the internet with. If your browser reaches the server at another address, for example because the server is behind NAT, pass that address as `HARBLET_URL`:

```bash [Server]
curl -fsSL https://raw.githubusercontent.com/harblet/harblet/main/install.sh | sudo HARBLET_URL=http://203.0.113.10:3000 sh
```

## Options

The install script reads these environment variables:

<field-group>
<field name="HARBLET_URL" type="string">

The address your browser reaches Harblet at, with `http://` and port `3000`. Defaults to the server's IPv4 address.

</field>

<field name="HARBLET_BACKUP" type="string">

The path to a backup of Harblet's database to restore, the `.dump` file from your backup destination. Needs `HARBLET_APP_SECRET`. See [Backing up Harblet](https://harblet.com/docs/backups/harblet-backups#restore-harblet-onto-a-new-server).

</field>

<field name="HARBLET_APP_SECRET" type="string">

The app secret of the install the backup comes from. Generated when not set.

</field>
</field-group>

## What the script sets up

- **k3s**, the lightweight Kubernetes distribution, at the version this Harblet release was tested with. Traffic between servers is encrypted with WireGuard, and Kubernetes secrets are encrypted at rest.
- **Traefik**, which comes with k3s, on ports 80 and 443. It redirects HTTP to HTTPS and routes your domains to your services.
- **Harblet** and its own PostgreSQL database.
- **A container registry** inside the cluster for the images Harblet builds, and **BuildKit** to build them without root. Harblet sets both up when it starts.

Everything after that happens in Harblet's browser interface.

## If the install fails

The script stops with a message that says what went wrong. Once k3s is being installed, a failure prints:

```text
Installing Harblet failed. To start over, run /usr/local/bin/k3s-uninstall.sh and then this script again.
```

Run `sudo /usr/local/bin/k3s-uninstall.sh`, fix the cause, and run the install command again.

## Next steps

<card-group>
<card icon="i-lucide-rocket" title="Quickstart" to="https://harblet.com/docs/getting-started/quickstart">

Deploy your first service and put it on your domain.

</card>

<card icon="i-lucide-globe" title="Harblet's domain" to="https://harblet.com/docs/administration/harblet-domain">

Reach Harblet at your own domain over HTTPS.

</card>
</card-group>


## Sitemap

See the full [sitemap](https://harblet.com/sitemap.md) for all pages.