Kapable On-Prem
Run the entire Kapable platform on a server you own — the same services, the same deploy pipeline, the same console that power the cloud, installed by one command against your own domain. With this documentation and a license key, you can stand up a production-shaped Kapable from a blank Ubuntu box.
What you get
A single-box installation of the full v2 platform: PostgreSQL,
the Berth (the deploy manager), the Caddy edge with automatic TLS,
the service fleet (auth, gateway, hosting, console, launchpad, CI,
and the rest), a first organization with an owner account, and a
deployed sample app served over a real certificate at
<app>.<org>.yourdomain.com.
The installer is a 10-node dependency graph, not a
script: every node checks before it changes, reports
APPLIED or NO-CHANGE, and the whole graph is
safe to re-run at any time. A from-zero install on a wiped box takes
about 12 minutes; a verification re-run about 5.
Prerequisites
| Requirement | Details |
|---|---|
| Server | Ubuntu 24.04 LTS, amd64. 4 vCPU / 8 GB RAM / 150 GB disk is proven sufficient for the full stack with headroom. |
| Access | Root SSH (key-based) from the machine you run the installer on. |
| Network | A public IPv4 address; ports 80 and 443 reachable from the internet (required for ACME certificate issuance). |
| Domain | A base domain you control (e.g. example.com) with the DNS records below. |
| ACME email | An email address for Let's Encrypt registration and expiry notices. |
| SMTP (optional) | Credentials for outbound mail. Skip entirely with --no-mail; everything else works without it. |
| License key | Issued by Kapable. See Licensing. |
DNS records
Point three records at your server's public IP before installing:
| Record | Type | Serves |
|---|---|---|
example.com | A | The platform apex. |
*.example.com | A | Org hosts (acme.example.com) and platform services (api., releases., …). |
*.*.example.com | A | App hosts — deployed apps live at <app>.<org>.example.com, two labels deep. |
The two-level wildcard is not optional. A DNS wildcard
(*.example.com) matches any depth, so app hostnames will
resolve without the third record — but the TLS edge
matches site addresses one label at a time, so without an explicit
two-level entry the handshake for app.org.example.com is
refused even though DNS answers. If TLS fails while
dig succeeds, check this first.
Built for AI-assisted installation
These pages are public by design, so you can hand them to your AI assistant before you have an account or a license — and the installer is built to be driven by one: every error names its cause and the corrective action in the message itself, the graph is idempotent so a failed run is simply re-run after the fix, and the final seal check gives an unambiguous, machine-readable exit code. Point your agent at this section and let it drive.
Next Steps
Install
The one command and the 10-node graph behind it.
Licensing
License keys, activation, and the bootstrap window.
Verify
The seal check: prove your install is correct.