Skip to content
EntryWick documentation

For whoever is about to rent or pick a server for a self-hosted EntryWick.

Requirements for a self-hosted server (week 21)

What a server needs before entrywick install will run on it, and what it has to be able to reach once it runs. entrywick install checks the first half itself and refuses a server that falls short. PRICING_ENTITLEMENTS §5, ADR-019. Next: install.md.

Who opens it: whoever is about to rent or pick a server for a self-hosted EntryWick.

What they came to do: choose a server size, and know which DNS records, ports and outbound connections to arrange before installing.

What must be true when they leave: the server they pick is big enough for their largest event, and nothing the install needs is blocked.

Size

Size the server for the largest single event it will run: attendees on that event's confirmed registrations.

Attendees per event vCPU Memory Free disk
up to 2,000 2 4 GB 20 GB, 40 GB recommended
up to 10,000 4 8 GB 40 GB or more
more than 10,000 ask EntryWick before you choose a server
  • Memory is checked with some room: a "4 GB" server that reports 3.8 GB to the system is accepted.
  • Below 2 vCPU or 4 GB, install refuses. --skip-requirements installs anyway, for a trial; do not run an event on it.
  • The database's memory is set for the size of the server when .env is written (MYSQL_BUFFER_POOL: 768M under 7 GB, 1G under 15 GB, 2G above).
  • Upload scanning (the optional clamav service) needs about 1.5 GB more memory.

Disk

install refuses under 20 GB free and warns under 40 GB. Once running, entrywick doctor warns under 10 GB free and fails under 2 GB. What takes the space:

  • the EntryWick image and the MySQL, Redis and Caddy images;
  • the database and the stored files (ticket images, uploads, rosters, exports, brand assets);
  • the app's own nightly database dump, 30 of them kept on the storage volume;
  • entrywick backup: each backup is a database dump and an archive of every stored file, 5 kept (backup.md).

When the stored files grow past a few GB, grow the disk or keep fewer backups (--keep=).

System

Needed Checked by install
Operating system Ubuntu 24.04 LTS, 64-bit x86 (amd64). The image is built for amd64 only; ARM servers are not supported Another system is a warning, not a refusal
Docker Engine 24 or newer, from Docker's own apt repository (install.md, step 4) Refused when missing, not running or older
Docker Compose The v2 plugin, 2.24 or newer (docker-compose-plugin; not the old docker-compose program) Refused when missing or older
PHP php8.3-cli, Ubuntu 24.04's own package. entrywick needs nothing else from PHP; the app itself runs in its image entrywick stops at once on PHP older than 8.3
User entrywick runs as root (it runs Docker and writes to /opt/entrywick) A warning when not root
Nothing else on 80 and 443 EntryWick's Caddy serves both. Stop and disable any web server already there (Apache, nginx) Refused when either port is taken

Domain and DNS

EntryWick needs a domain of its own — usually a subdomain of the organization's, such as events.example.org. Every address it serves sits under it:

Address What
events.example.org the platform's own address
riverside.events.example.org the organization (its admin at /admin, its event pages) — the name is chosen at install
scan.events.example.org the scanner app
api.events.example.org the API

Before installing, create two A records pointing at the server's public IPv4 address:

events.example.org.     A   203.0.113.10
*.events.example.org.   A   203.0.113.10

Certificates are issued by Let's Encrypt for each address the first time it is visited, which only works once these records point at the server. If the domain also has AAAA records, they must point at the same server. No DNS provider token is needed.

A custom domain an organization adds later (Settings) needs its own record, as on the cloud.

Ports

Inbound, open in the provider's firewall and in ufw if it is active:

Port For
22/tcp SSH, to run entrywick
80/tcp certificate checks and the redirect to https
443/tcp everything EntryWick serves
443/udp HTTP/3 (optional; browsers fall back to 443/tcp)

MySQL and Redis are never published to the internet.

Outbound connections

To When If blocked
download.docker.com, Ubuntu's package mirrors installing Docker and PHP nothing installs
ghcr.io (and pkg-containers.githubusercontent.com) install and update: the EntryWick image, and Sigstore's cosign image that checks its signature install and update fail (exit 5 or 6)
Docker Hub (registry-1.docker.io, production.cloudflare.docker.com) install and update: the MySQL, Redis and Caddy images; rclone for offsite copies install fails
Sigstore: tuf-repo-cdn.sigstore.dev, rekor.sigstore.dev install and update: checking that EntryWick's release workflow signed the image install and update refuse (exit 5). An install with no internet access is not supported
where entrywick.phar is downloaded from installing the tool (the address is pending: install.md, step 6) download it elsewhere and copy it over
acme-v02.api.letsencrypt.org (Caddy may also use ZeroSSL, acme.zerossl.com) the first visit to each address, and renewals no certificates: browsers and the scanner app refuse to connect
license.entrywick.io (https) the nightly heartbeat, 03:45 UTC (heartbeat.md) nothing stops; a warning after 30 days, and update does not learn about new releases
your mail provider (SMTP on 587 or 465, or its API) every email the app sends email is not delivered. Many VPS providers block port 25
api.pwnedpasswords.com setting a password: it is checked against known breaches the breach check is skipped
an S3-compatible bucket (Backblaze B2, S3, …) nightly offsite copies, if set up (backup.md) copies are not made; app:healthz shows them late

Integrations an organization connects (Stripe, Twilio, email list providers, …) need their own hosts, as on the cloud.

Email

The app sends invitations, password resets, registration confirmations and tickets by email. Until .env has the settings of a mail provider (SMTP or a provider's API), every message is written to the app's log instead of being sent (install.md, step 9).

Backups

Backups are the operator's: entrywick backup writes to the server's own disk, and a copy off the server needs an S3-compatible bucket, or another place the backup directories are copied to. backup.md.