Server Preparation Checklist

Complete these steps before your scheduled deployment session. Your account manager will connect remotely to finish the installation once the server is ready.

You only need to complete steps 1–7. Everything after that — software installation, configuration, and go-live — will be handled by the Lokawatch team during your deployment session.

Click the copy button next to each command, then paste and run it in your terminal — one line at a time.

Verify Server Specifications

Provision a server meeting the following requirements. A cloud VPS (DigitalOcean, Hetzner, AWS, or similar) or a physical machine on your network both work.

Operating System	Ubuntu 24.04 LTS (64-bit)
CPU	Minimum 4 cores · Recommended 8 cores
RAM	Minimum 8 GB · Recommended 16 GB
Disk	Minimum 100 GB SSD · Recommended 200 GB
Network	Static IP address or a registered domain name
Open Ports	22 (SSH) · 80 (HTTP) · 443 (HTTPS)

Using Cloudflare Tunnel? You only need port 22 (SSH) open. Ports 80 and 443 stay closed locally — Cloudflare handles inbound traffic through the tunnel. The firewall section below explains this.

Initial System Update

Run as root

# Update the package list

apt update

# Upgrade all installed packages

apt upgrade -y

# Set your server's hostname (replace with your chosen name)

hostnamectl set-hostname your-server-name

# Set your timezone

timedatectl set-timezone Asia/Jakarta

Create the Deployment User

Run as root

Create a dedicated deploy user. This account will own the application and is the account your Lokawatch team will use remotely. Do not use root for deployment.

# Create the user (no password — SSH key login only)

adduser --disabled-password --gecos "" deploy

# Allow deploy to run any command with sudo without a password prompt

echo "deploy ALL=(ALL) NOPASSWD: ALL" | tee /etc/sudoers.d/deploy

# Lock down the sudoers file permissions

chmod 440 /etc/sudoers.d/deploy

# Switch to the deploy user for all remaining steps

su - deploy

After running su - deploy your prompt will change. Steps 4–7 run as the deploy user.

Install Supporting Tools

Run as deploy

These utilities are needed during deployment and for ongoing server management.

# Install all required tools in one command

sudo apt install -y vim git curl wget unzip make htop net-tools ufw fail2ban ca-certificates gnupg lsb-release

Install Docker

Run as deploy

Use the official Docker repository — not the Ubuntu default package, which is outdated.

Add Docker's GPG key

sudo install -m 0755 -d /etc/apt/keyrings

curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg

sudo chmod a+r /etc/apt/keyrings/docker.gpg

Add Docker repository

# This is one long command — copy the entire line

echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null

Install Docker Engine

sudo apt update

# This is one long command — copy the entire line

sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin

Enable Docker service and add deploy to the docker group

sudo systemctl enable docker

sudo systemctl start docker

# docker group now exists — add deploy to it

sudo usermod -aG docker deploy

Make docker-compose available as a command

# Create a symlink so docker-compose works as a standalone command

sudo ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/local/bin/docker-compose

Verify with: docker --version and docker-compose version

Run exit && su - deploy now — logging out and back in as deploy activates the Docker group membership so you can use docker without sudo in the remaining steps.

Configure Firewall

Run as deploy

Open only the ports required for your setup. Run these commands in order.

Do not run sudo ufw enable before allowing SSH port 22, or you will lock yourself out of the server.

VPS provider firewall: Many providers (DigitalOcean, Hetzner, Vultr, Linode) have their own firewall panel that blocks traffic before it reaches your server. UFW rules won't help if the provider's firewall is blocking the port. Always check both UFW and your provider's firewall settings.

Using Cloudflare Tunnel? Skip port 80 and 443 — you only need SSH. The tunnel connects outbound, so no inbound ports (other than 22) are required.

Set default policies

sudo ufw default deny incoming

sudo ufw default allow outgoing

Allow required ports

sudo ufw allow 22/tcp← SSH — keep this open always

sudo ufw allow 80/tcp← HTTP

sudo ufw allow 443/tcp← HTTPS

Enable and verify

sudo ufw enable

sudo ufw status verbose

Generate SSH Key & Share It

Run as deploy

The Lokawatch team will need the public key to access the server during deployment.

# Generate an SSH key pair (press Enter if asked for a passphrase)

ssh-keygen -t ed25519 -C "deploy@your-server" -f ~/.ssh/id_ed25519 -N ""

# Display the public key — copy the output and send it to your account manager

cat ~/.ssh/id_ed25519.pub

Send the full output of cat ~/.ssh/id_ed25519.pub to your Lokawatch account manager. The private key (id_ed25519) stays on the server — never share it.

Your server is ready

Once all 7 steps are complete, notify your Lokawatch account manager. We will schedule a remote session to complete the installation, configure your cameras, and hand over the system.

Quick Checklist

Ubuntu 24.04 LTS installed, minimum 8 GB RAM, 100 GB SSD
System updated (apt update then apt upgrade)
deploy user created and added to the docker group
Supporting tools installed (git, curl, vim, etc.)
Docker Engine and docker-compose installed and running
Firewall enabled — ports 22, 80, 443 open
SSH key generated — public key sent to account manager

On-Premise Installation