Install

Read What you need first: the panel's domain must point to the server before you start.

The one-line install

On the server, as your own user:

curl -fsSL https://get.whitesmoke.cloud/install.sh | sudo bash -s -- --domain panel.example.com --email you@example.com --accept-eula

--domain is the panel's address.
--email is the address Let's Encrypt uses for your certificate account.
--accept-eula says you accept the licence agreement. Without it, and with no terminal to ask you on, the installer stops.

Before it changes anything, the installer checks the list of releases and the release itself: their signatures, that the list hasn't expired, and that every file is exactly the one listed. If any check fails, it stops and nothing on the server is changed.

What the one line trusts: the installer checks every file it downloads, but it can't check itself. It comes over HTTPS, so you trust that connection and get.whitesmoke.cloud for that one file. The careful way below checks that file too, against the release keys printed on this site. That protects against a file changed on the way or on the server, but the keys come from the same site; a second, independent place to compare the fingerprints comes before the public launch.

The careful way: check the installer first

Download the installer and its signature:

curl -fsSLO https://get.whitesmoke.cloud/install.sh
curl -fsSLO https://get.whitesmoke.cloud/install.sh.r_20261021_ydnetk.sig

Save the release keys, exactly as printed here, in a file named allowed_signers:

whitesmoke-release namespaces="whitesmoke-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEs4Vd12oiDxgHoJEwmQokjCOlA910ALSCU56KDWjdOJ r_20261021_ydnetk
whitesmoke-release namespaces="whitesmoke-release" ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKkh1BnfQVlmkfFvcgr2zFe0A1l4eJZQRQkJHbRsKC7N r_20261021_u4y29j

Check the signature:
```
ssh-keygen -Y verify -f allowed_signers -I whitesmoke-release -n whitesmoke-release -s install.sh.r_20261021_ydnetk.sig < install.sh
```
It must say: Good "whitesmoke-release" signature for whitesmoke-release with ED25519 key SHA256:5ZLU2cN3c9GbRgSjbpVdD6m9Ix9pR5CTp4IRdynO+C4. Anything else: stop, don't run it, and tell us.

Run the checked file:

sudo bash install.sh --domain panel.example.com --email you@example.com --accept-eula

The two release keys and their fingerprints:

Key	Fingerprint
`r_20261021_ydnetk` (active)	`SHA256:5ZLU2cN3c9GbRgSjbpVdD6m9Ix9pR5CTp4IRdynO+C4`
`r_20261021_u4y29j` (standby)	`SHA256:Lcu0nozrhu5BM9cxdobMY7mQgbPSaj/NzsGjPUy+cRA`

They are also on the release keys page, with how key changes work.

After the install

Create the first admin. The command asks for the password, so it never shows on a command line:
```
sudo -u whitesmoke-panel php8.5 /srv/panel/current/artisan smp:admin
```
Sign in at https://panel.example.com. The panel first asks you to set up two-factor sign-in.
Keep a copy of /srv/panel/shared/.env somewhere safe. It holds the key without which the panel's sessions and encrypted settings can't be read.

If the installer says the server isn't registered with the license server yet, register it once the server can reach the internet:

sudo -u whitesmoke-panel php8.5 /srv/panel/current/artisan smp:license register

If the install stopped halfway

If the first install stopped (for example because the panel's domain didn't point to the server yet), fix the cause, then finish it with the installer run as a file, after checking it the careful way above:

sudo bash install.sh --update --domain panel.example.com --email you@example.com --accept-eula

The one-line install won't run again on a server that already has the panel; it tells you this.

Test certificates

The one-line install gets real certificates from Let's Encrypt. To try things out with Let's Encrypt's test certificates instead (browsers warn about them), add --ca staging.