# From zero to HTTPS. > System requirements, a Slashfile quick start, the SPMPlus panel with Docker, and the firewall ports Slash needs. Slash runs on its own with a Slashfile, or together with the SPMPlus panel. Both ways use the same proxy, and you can move from one to the other later. ## System requirements | | | | --- | --- | | OS | 64-bit Linux, kernel 4.18 or newer (5.10 or newer recommended) | | Architecture | `x86_64`, `aarch64` | | x86_64 CPU | Baseline x86-64. AVX, AVX2 and AVX-512 are not required; AES-NI is detected at runtime and strongly recommended | | aarch64 CPU | ARMv8-A. Crypto Extensions recommended (Raspberry Pi 5, Graviton and Ampere have them) | | libc | Not needed: Slash is a static musl binary | | Docker | Docker Engine 20.10 or newer with Compose v2 | | Native | systemd 247 or newer: Debian 11/12, Ubuntu 22.04/24.04, RHEL/Rocky/Alma 9, Fedora 34+ | ### VM size | | Minimum | Recommended | High traffic | | --- | --- | --- | --- | | vCPU | 1 | 2 | 4+ | | RAM | 512 MB | 2 GB | 4 GB+ | | Disk | 1 GB | 10 GB SSD | 20 GB SSD with log rotation | | Capacity | About 1,000 concurrent users | About 10,000 concurrent users | Tens of thousands of requests per second | Idle: Slash about 28 MB, panel about 24 MB. Each open connection about 45–60 KB. ## Quick start: Slash with a Slashfile No panel. Write a `Slashfile`, run the container, done. The master key and admin token are created automatically in the data directory. ``` email admin@example.com example.com, www.example.com proxy localhost:3000 blog.example.com wordpress /var/www/blog api.example.com laravel /var/www/api docs.example.com files /srv/docs ``` ```sh docker build -f docker/Dockerfile.proxy --target final -t slash . docker run -d --name slash --network host --restart unless-stopped \ -v "$PWD/Slashfile:/etc/slash/Slashfile:ro" \ -v /var/www:/var/www:ro \ -v slash-data:/data/proxy \ slash docker exec slash /slash reload # after editing the Slashfile ``` Before a reload, check and tidy the file: ```sh slash check # validate, with line numbers and suggestions for typos slash fmt # align the columns ``` PHP with php-fpm in another container, where the application path differs: ``` library.example.com php /srv/library via library-php:9000 fpm-root /var/www/html ``` ## Quick start: SPMPlus with Docker All commands run on the server, in the `docker` directory of the repository. ### 1. Clone ```sh git clone https://kubeman.unej.ac.id/geohot/slash.git cd slash/docker ``` ### 2. Create the secrets `sudo` is needed to hand the files to UID 10001, the user inside the containers. Back up `secrets/master.key`: without it, stored private keys and DNS tokens cannot be decrypted. ```sh sudo ./gen-secrets.sh # secrets/master.key and secrets/admin.token ``` ### 3. Run Then read the one-time setup token from the panel log. ```sh docker compose up -d --build docker compose logs panel | grep -i "setup token" | tail -1 ``` ### 4. Open the panel The panel listens on `127.0.0.1:8443` only. Reach it through an SSH tunnel from your computer, enter the setup token and create the admin account. ```sh ssh -L 8443:127.0.0.1:8443 user@server # then open http://localhost:8443 ``` ### 5. Add a host **Hosts → Add host**: domain, upstream (for example `http://127.0.0.1:3000`), preset, SSL, preview, then save and apply. The certificate is issued within seconds once DNS points at the server. Recommended for HTTP/3, larger UDP buffers: ```sh printf 'net.core.rmem_max = 7500000\nnet.core.wmem_max = 7500000\n' | sudo tee /etc/sysctl.d/90-spmplus.conf sudo sysctl --system ``` ## Firewall Open exactly three ports: `80/tcp`, `443/tcp` and `443/udp`. Without `443/udp` browsers fall back to HTTP/2; without `80/tcp` the Let’s Encrypt HTTP-01 challenge fails. Keep `9180` (metrics) and `8443` (panel) closed. Ubuntu, Debian (ufw): ```sh sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw allow 443/udp ``` Rocky, AlmaLinux, RHEL, Fedora (firewalld): ```sh sudo firewall-cmd --permanent --add-service=http --add-service=https --add-port=443/udp sudo firewall-cmd --reload ``` On cloud servers, allow the same three ports in the provider’s firewall too. ## Documentation Full references live in the repository. The documents are written in Indonesian. - [Slashfile reference](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/slashfile.md): Sites, paths, HTTPS, PHP, WAF, TCP/UDP and commands - [Kubernetes Ingress controller](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/kubernetes.md): Install, annotations, TLS - [AssaultCuirass WAF](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/waf.md): How it works, accuracy, false positives - [Native install](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/install-native.md): systemd, without Docker - [Operations](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/operations.md): Upgrade, backup, restore, monitoring - [Benchmarks](https://kubeman.unej.ac.id/geohot/slash/-/blob/main/docs/benchmarks.md): Method and how to rerun them