Install on a new server

With a license key, Synq installs on a fresh server with one command. You don't need the source code, Git or anything on your own computer: log in to the server and run the installer.

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY>

It installs Docker if the server doesn't have it, asks you for the admin account, and starts Synq: the panel, its API and database, and the web edge that serves your apps on ports 80 and 443.

Requirements

• A Linux server on x86_64 (amd64) or arm64 (aarch64, such as AWS Graviton): Ubuntu 22.04 or newer, or Debian 12 or newer.
• 2 GB of RAM or more (4 GB recommended) and about 10 GB of free disk.
• Ports 80 and 443 open to the internet. Without a domain, open port 3001 too (see below).
• Outbound HTTPS to synquic.tech, for the license check-ins (see Licensing).
• A shell on the server as root, or as a user that can use sudo.
• A license key.

Get a license key

Email p@synquic.com to get a license key.

A key looks like synq_ followed by about 43 letters, digits, - and _. It is what lets a server download Synq and its updates, and what the installed panel checks in with, so keep it like a password: don't paste it into chat or commit it.

Install without a domain

The quickest way to try Synq. On the server, run:

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY>

The installer asks for the admin account's email and password (8 characters or more), then serves the panel on http://<server IP>:3001. Open that port in the server's firewall (on AWS, in its security group) and sign in with the email and password you chose.

Install with a domain

First create a DNS A record for the name you want the panel on (for example panel.example.com) pointing at the server's public IP. Then run the installer with --domain and --email:

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY> \
  --domain panel.example.com --email you@example.com

The panel comes up on https://panel.example.com with a free Let's Encrypt certificate. --email is where Let's Encrypt sends certificate notices, and the admin account's email unless you pass --admin-email. If the DNS record doesn't point at the server yet, the installer says so; Synq keeps retrying the certificate in the background, so it is issued as soon as the record resolves.

Install next to another web server

If the server already runs a web server that must keep ports 80 and 443 (nginx serving other sites, for example), install with --edge off:

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY> --edge off

With the edge off:

• Nothing on ports 80 and 443 is probed, stopped or taken over, and the other web server's configuration and certificates are left alone. Synq's edge container is not created.

• The panel, its API, the database and Redis start as usual. The panel and the API listen on 127.0.0.1 only, so reach the panel through an SSH tunnel from your computer:

  ssh -N -L 3001:127.0.0.1:3001 <user>@<server>

  then open http://localhost:3001. If port 3001 was taken on the server, the installer prints the tunnel command with the port it used.

• Apps deploy and run on the ports they publish. Domains, routes and certificates wait: the panel shows Edge is off on this server; domains and certificates activate when the edge is turned on instead of an error.

• --domain works too: the panel's domain is recorded and served once the edge is on.

• The setting is kept: running the installer again, synq up and synq update all keep the edge off.

When Synq should serve ports 80 and 443, turn the edge on with sudo synq edge on --migrate (or --takeover). See Turn the edge on or off.

Options

Apps you deploy get a free subdomain right away: <app>.<apps domain> with --apps-domain, else <app>.<panel domain> with --domain (both need the wildcard record), else <app>.<ip-with-dashes>.sslip.io, which needs no DNS at all. The installer prints which one applies. Change it later with sudo synq apps-domain set <domain> or in Settings, Instance, Apps domain.

The admin password is always asked on the terminal, or read from the SYNQ_ADMIN_PASSWORD environment variable. For an install with no one at the keyboard, read both secrets into the environment first so they don't end up in your shell history:

read -rs SYNQ_KEY && export SYNQ_KEY                        # paste the key, press Enter
read -rs SYNQ_ADMIN_PASSWORD && export SYNQ_ADMIN_PASSWORD  # type the admin password
curl -sSL https://synquic.tech/install.sh | sh -s -- --admin-email you@example.com

What the installer does

1. Checks the server (Linux, x86_64 or arm64, memory) and your license key.
2. Installs Docker and its compose plugin if they are missing, from the distribution's packages.
3. Downloads the Synq command-line tool for the release, verifies its checksum and installs it under /root/.synq, with a synq command in /usr/local/bin. If the server has no Node.js 22 or newer, it fetches an official Node.js 22 from nodejs.org for Synq alone (checksum-verified), without touching the system.
4. Logs Docker in to synquic.tech with your key, so it can pull Synq's images. The key is stored in Docker's credential file for root (/root/.docker/config.json); it is never printed or put on a command line.
5. Gives this installation an ID (inst_ and 20 random characters) the first time, and keeps it and your license key in Synq's settings file, /root/.synq/compose/.env (readable by root only), for the panel's check-ins. Running the installer again keeps the same ID.
6. Starts Synq with Docker Compose, creates the admin account, and with --domain serves the panel on your domain and requests its certificate. The panel checks in as it starts, and the installer tells you when its license is active.

Synq runs as root. Manage it with sudo:

sudo synq status    # is it running, its ports, and the API's health
sudo synq doctor    # checks the database and services, and can repair them (--fix)

Licensing

The panel checks in with https://synquic.tech when it starts and then every hour. Each check-in sends:

• the installation ID,
• the Synq version,
• the panel's address (its domain, or http://<IP>:3001) and the server's public IP when Synq knows it,
• the host name and operating system,

with your license key to identify you. Nothing about your apps, users or data is sent. The answer is a lease signed by Synquic, good for 72 hours; the panel checks the signature, so only Synquic can issue one.

When a license is blocked (the key was revoked, or the installation was blocked), the panel locks at its next check-in, within the hour. When the panel can't reach synquic.tech for 72 hours, it locks too, and unlocks as soon as a check-in gets through. A locked panel shows This Synq panel is not active on every page, with the reason, the installation ID and the address to write to. Signing in still works, and an administrator can paste a new license key there. Your deployed apps keep running the whole time; only the panel (deploying, editing, settings) is paused.

If a fresh install shows not activated yet, the first check-in didn't get through: check that the server can reach https://synquic.tech (outbound port 443), then press Retry. The panel also retries every hour.

What the license allows is in License terms.

Upgrade

Run the same command again. On a server where Synq is already installed, the installer upgrades it to the newest release (or to --version) and keeps the database, settings, certificates, the installation ID and the address the panel is served on. Your deployed apps keep running. A new license key given here replaces the old one.

curl -sSL https://synquic.tech/install.sh | sh -s -- --key <KEY>

--domain and the admin options only apply to the first install; on an upgrade they are ignored. To give an installed panel a domain, or move it to another one, run sudo synq panel-domain <host> --email <email> instead (see Move the panel to a domain later). Going back to an older version is refused, because database changes only go forward. synq update on such a server tells you to run the installer again.

Troubleshooting

Next steps