Automatic installation — Arcivéo

The automatic way: a single script from your account prepares the entire server (Apache + PHP web stack, database, security tools, cron). After that — deploy the dashboard, issue an SSL certificate and enter your license. Works on Ubuntu/Debian: on a fresh VPS it sets everything up from scratch, on an already-configured server it acts additively only (the "Configured server" profile, step 01). All the commands below are in order — just scroll from top to bottom.

Choose a method Manual install FAQ reference

Replace the placeholder values in the commands with your own: monitor.example.com — your domain; 203.0.113.10 — the server's real IP; /var/www/monitor — the dashboard root (where public/, assets/ and config.php live); choose your own database password.

The full set ("Full protection") is meant for a fresh VPS. On a clean Ubuntu/Debian it configures the security system from scratch — Fail2ban (jail.local), the root crontab, UFW rules, the Apache config. If the server is already configured (a working dashboard, sites, mail, your own jails), choose the "Configured server" profile: it makes only additive changes and leaves your firewall, Fail2ban, mail, SSH and sysctl untouched. When a hosting panel is detected, the script switches to this mode on its own. Before the first run you can enable a dry run (a checkbox in your account) — it shows what would be done without changing anything. On a live server, take a snapshot just in case.

01. Auto-setup command from your account

Get the command in your account my.arciveo.com → the "Server setup" section (available after you subscribe to Arcivéo Monitor). It is tied to your account and contains a personal token.

The script provisions the whole server: the web stack (Apache + PHP), the database, SSL tools, the full set of security tools and cron jobs (Lynis, SMART, debsums, Logwatch, a daily report, ipsum updates).

1) Choose a protection level (in your account, before copying the command):

Full protection (recommended) — UFW (firewall), Fail2ban, CrowdSec + bouncer, ipsum (IP blocklist), Suricata (IDS/IPS), Falco, ModSecurity + OWASP CRS (WAF), PSAD, mod_evasive (anti-DoS), AIDE (file integrity), debsums, ClamAV + maldet (antivirus), Auditd, AppArmor, Monit, Lynis (audit), Logwatch, automatic security updates.
Lightweight — for low-RAM VPS: a basic set without heavy components.
Configured server (hosting panel) — for an already running server with a panel (HestiaCP, etc.), sites and mail: only additive changes (installing extra tools, cron, sudo rules), while the firewall, Fail2ban, mail, SSH and sysctl stay as they are. On a server with a panel the script picks this mode by itself.

Dry run. In your account you can tick "Dry run" — then the command will only show what the script would install and change, and exit without touching anything. Handy on an already-configured server: do a dry run first, then a real run without the checkbox.

2) Run the command from your account on the server as root — it looks like this:

curl -fsSL "https://my.arciveo.com/install.php?token=YOUR_TOKEN" | sudo bash

Keep the command secret — it is tied to your account. The link has a limited lifetime; if it has expired, click "Get a new link" in your account.

After auto-setup the web server is Apache + PHP-FPM, and the security tools and cron jobs are already installed and working out of the box — nothing else needs configuring.

02. Domain and DNS

To open the dashboard at an address like monitor.example.com and get a free SSL, the domain must point to the server. In the DNS control panel (at your registrar or host), create an A record:

Type: A Name: monitor (subdomain → monitor.example.com) or @ (root domain → example.com) Value: 203.0.113.10 ← your server's IP TTL: 3600

After a few minutes (sometimes up to an hour), check that the domain points to the server:

dig +short monitor.example.com # should return your IP # or, if dig is unavailable: getent hosts monitor.example.com

The SSL certificate (step 06) is issued only for a domain — so DNS must point to the server before the certificate is issued.

03. Upload the panel files

Auto-setup has already created the panel directory /var/www/monitor and configured the Apache site (DocumentRoot at the panel root, PHP-FPM, AllowOverride for .htaccess). There's no need to create the directory and vhost separately — just upload the files and set permissions.

The panel files (the distribution archive) are downloaded after purchase in your account at my.arciveo.com → "Downloads". Unpack the archive before uploading it to the server.

Upload the distribution contents to /var/www/monitor (so that public/, assets/, config.php etc. end up inside) — via SFTP/SCP (FileZilla / WinSCP) or with the scp command from your local computer:

scp -r ./monitor/* deploy@203.0.113.10:/var/www/monitor/

To have your domain written into the vhost right away (ServerName), pass it to the auto-setup command back in step 01: … | sudo bash -s -- monitor.example.com (or enter the domain in the "Panel domain" field in your account). If no domain is passed, the panel responds on any host and by IP, and certbot will write the ServerName when issuing the SSL (step 06); nothing needs to be reinstalled.

Set file permissions — this is a required step. If you uploaded as root or via SFTP, the files belong to root, and the web server (www-data) won't be able to read them — the panel will open blank or with a 403 error (in the log: .htaccess unreadable / directory not executable). The command below fixes it:

# Normalize permissions for the whole webroot: a directory created by root is # inaccessible to the web server (www-data) — without this the panel serves a blank page or 403. cd /var/www/monitor # Create the working folders BEFORE chown — otherwise the new directories stay root:root # and with chmod 750 the web server (www-data) won't be able to write to them. sudo mkdir -p data/lynis data/logwatch tmp logs sudo chown -R www-data:www-data /var/www/monitor sudo find /var/www/monitor -type d -exec chmod 755 {} \; sudo find /var/www/monitor -type f -exec chmod 644 {} \; sudo chmod 640 /var/www/monitor/config.php sudo chmod 750 data tmp logs

Open up SFTP uploads for yourself. After the command above all files belong to www-data, while FileZilla / WinSCP connect as your own user — an upload will fail with SSH_FX_PERMISSION_DENIED (Permission denied). Choose one of the two options.

Option A — an ACL for your user only (recommended). Write access goes to you alone; the web server still cannot overwrite the panel code:

sudo apt install -y acl # Write access for your user to the whole panel directory: sudo setfacl -R -m u:deploy:rwX /var/www/monitor # The same rule as the default — for files and folders created later: sudo setfacl -R -d -m u:deploy:rwX /var/www/monitor

Option B — via the www-data group. Simpler, but the web server gets write access to the panel files as well: with a vulnerability in PHP the code could be replaced. The order of the commands matters — config.php and the working folders are locked down last:

sudo usermod -aG www-data deploy # Group write access + setgid (the 2 bit): files uploaded over SFTP stay # in the www-data group — otherwise the panel cannot overwrite them. sudo find /var/www/monitor -type d -exec chmod 2775 {} \; sudo find /var/www/monitor -type f -exec chmod 664 {} \; sudo chmod 640 /var/www/monitor/config.php sudo chmod 2750 /var/www/monitor/data /var/www/monitor/tmp /var/www/monitor/logs

After option B reconnect in FileZilla (Server → Disconnect, then log in again) — the new group only takes effect on a new login, and until then you still have no rights. Check: id deploy — www-data must appear in the group list; ls -ld /var/www/monitor — permissions drwxrwsr-x, where the letter s instead of x means setgid is set.

04. Database

Create the database and user, then import the schema. Paste the DB block into the terminal as a whole (sudo mysql logs in as root over the unix socket — no root password needed). monitor_db and monitor_user are example names; you can set any of your own. Remember the database name, user and password — you'll enter them in config.php in the next step:

# 1. Database. The password is set ONCE in DBPASS and inserted into every line. # Paste the block into the terminal AS A WHOLE; sudo mysql logs in as root over the unix socket # (no root password needed). Do NOT use the interactive `sudo mysql -u root -p` # with copy-paste — on paste the SQL lines go into the password prompt and are lost. DBPASS='CHOOSE_A_PASSWORD' # ← change only this line sudo mysql <<SQL CREATE DATABASE IF NOT EXISTS monitor_db CHARACTER SET utf8mb4; CREATE USER IF NOT EXISTS 'monitor_user'@'localhost' IDENTIFIED BY '$DBPASS'; GRANT ALL ON monitor_db.* TO 'monitor_user'@'localhost'; FLUSH PRIVILEGES; SQL # Check (should show monitor_db): mysql -u monitor_user -p"$DBPASS" -e "SHOW DATABASES;" # Enter this same password in config.php → DB_PASS.

No need to import the schema — the dashboard creates the tables and the admin account itself on the first browser visit (from database/db.sql) if the database is empty.

sudo for the web server is already set up by the auto-configuration — modules see system data right away. You only need to configure sudo separately if PHP runs under a non-standard user (not www-data).

05. Configuring config.php

config.php in the panel root (/var/www/monitor/config.php) is the only file you need to edit by hand. All panel settings are defined in it as define() constants. Open it in an editor:

sudo nano /var/www/monitor/config.php

Fill in your own values in the highlighted spots; leave the rest as is:

// --- Database (from step 04) --- define('DB_HOST', 'localhost'); // leave as is define('DB_NAME', 'db_name'); // what you created in step 04 define('DB_USER', 'user'); // what you created in step 04 define('DB_PASS', 'db_password'); // what you set in step 04 define('DB_CHARSET', 'utf8mb4'); // leave as is // --- Application --- define('APP_URL', 'https://monitor.example.com'); // panel address, no trailing slash define('TIMEZONE', 'Europe/London'); // your timezone // --- Session lifetime --- define('SESSION_LIFETIME', 28800); // idle time before re-login, sec (28800 = 8 h)

What to change:

DB_NAME, DB_USER, DB_PASS — exactly the same database name, user and password you set when creating the DB in step 04 (if you kept the examples — monitor_db / monitor_user). Do not touch DB_HOST and DB_CHARSET.
APP_URL — the full panel address with https://, no trailing slash and no www. It must match the domain you activate the license on (step 07), otherwise the key will be rejected.
TIMEZONE — your timezone (list — timedatectl list-timezones). It only affects how the panel displays dates; it does not affect when cron jobs run (the system timezone applies there).
SESSION_LIFETIME — after how many seconds of inactivity the panel asks you to log in again (default 8 hours). E.g. 3600 = 1 hour, 86400 = 1 day.
The error-logging block (display_errors, log_errors, error_log) — leave at the defaults.

Save the file (Ctrl+O, Enter, then Ctrl+X) and restart PHP-FPM — otherwise the changes won't apply because of OPcache:

sudo systemctl restart php*-fpm

config.php is a secret file (it contains the DB password). It sits in the panel root, which is also the web root, but it is locked down: 640 permissions (set in step 03) and an explicit deny in the root .htaccess. Do not publish it to public repositories or send it to support with the real password.

A detailed breakdown of all parameters is in the FAQ: "The config.php file — all panel settings".

06. Issue an SSL certificate (HTTPS)

The dashboard works over HTTPS only. The login session uses a secure cookie, and WebAuthn (2FA) works only over HTTPS by standard. You will not be able to log in over http://.

certbot and the Apache plugin are already installed by auto-setup. Your domain's DNS should already point to the server (step 02). Issue it in one command:

sudo certbot --apache -d monitor.example.com

What certbot will ask:

Enter email address — your e-mail (certificate expiry notices go there).
Terms of Service … (Y)es/(N)o — Y.
Share email with the EFF … (Y)es/(N)o — your choice.

Then certbot issues the certificate itself, writes the <VirtualHost *:443>, sets up the http→https redirect and auto-renewal. At the end — Successfully enabled HTTPS.

If issuing fails, check that dig +short monitor.example.com returns the server's IP and that ports 80/443 are open (sudo ufw allow 80,443/tcp).

After issuing: https://monitor.example.com opens with a padlock, and http:// redirects to https://.

07. Login and initial setup

Open https://monitor.example.com, sign in with admin / useradmin and go through the checklist:

Change the admin password — the “Users” section in the menu.
Enable WebAuthn (2FA) — “WebAuthn keys” → register a key/passkey (requires HTTPS). Register two right away: if you lose your only key, you will not be able to sign in with it. Learn more.
Restrict access by IP — “Settings” → “IP access restriction” (add your own IP before enabling, or you will lock yourself out).
Enter your license — activate the ARCIVEO-… activation code from your account for your domain and paste the key into “Settings” → “License”. Learn more.
Set up notifications — Telegram and/or Email in “Settings”. Learn more.
Delete the installer public/start_db.php if it is still there: it lets anyone recreate the database without authorization. As long as the file sits in the dashboard root or in public/, the dashboard warns about it with a red banner.

Done. The security tools are already running — the dashboard immediately shows their status and Security Score. A reference for each tool is in the FAQ.

Choose a method FAQ reference