For self-hosters

Run several servers on one machine

Give each group its own snug server on one machine, behind one front door.

One Linux machine can run a separate snug server for each of several groups. Each server keeps its own license, containers, data, backups, and automatic updates. Prepare the machine once with set up your own snug server, then install each server as below.

Plan before the first install

Every server on the machine needs its own:

  • license
  • folder
  • name: up to 63 lowercase letters, digits, dashes, or underscores
  • call port range: at most 2,000 ports above 1023, shared with no other server
  • pair of front-door ports above 1023

A front door you run in front of every server owns TCP 80 and 443. Decide before the first install. A server installed without front-door ports takes 80 and 443 for itself, and install can't change that later.

Install each server

Install each server from its own folder. The installer puts snug/ inside the folder you run it from:

mkdir book-club && cd book-club && curl -fsSL https://snug.chat/install.sh | sh

Then install with this server's own name, ports, address, and license file:

./snug/snug-ops install --name book-club \
  --call-ports 16384-16783 --front-ports 10100,10200 \
  --domain book.example.org --ip 198.51.100.7 --license ~/book-club.lic

The server's containers and volumes take its name. install refuses a name another server on the machine already uses. Run every later command for this server from its own folder.

Put a front door in front

Each server's HTTPS edge listens only on its two front-door ports, on the machine's loopback address. The front door forwards HTTPS by server name to the second port with a PROXY protocol v2 header, so each server sees its members' own addresses. It forwards plain HTTP to the first port. snug hosting uses HAProxy for this. Any proxy that forwards TLS by server name and sends PROXY headers works.

Open every call range

Calls never pass the front door. Open each server's call range in every firewall and router in front of the machine. prepare opens only the default UDP and TCP 40000-40400 in UFW. ./snug/snug-ops ports, run from a server's folder, checks that server's own range.