Installation

Orbit’s self-hosted release repository is private, so installation starts from a one-time install code rather than a public download link — the code itself is what authorizes the download.

1. Generate an install code

Log into your Kuzium account at orbit.kuzium.com, open Account → Install, and generate an install code. It’s valid for 15 minutes and tied to your license.

You’ll be shown two ways to use it — a direct download per platform (win-x64, linux-x64, osx-x64, osx-arm64), or a one-line installer script for the server you’re setting up:

curl -fsSL https://license.kuzium.com/install.sh | sh -s -- <YOUR-CODE>

Run that on the server itself. It downloads the release bundle (compose files + the orbit-setup installer) and your license file automatically.

2. Run the installer

From the directory the bundle unpacked into:

./orbit-setup

orbit-setup checks that Docker is ready, then walks you through a short Q&A:

1. Install directory — must contain docker-compose.prod.yml (defaults to the current directory).
2. Public domain — e.g. https://orbit.example-corp.com. This drives emailed action links and the API’s advertised server URL.
3. License file — already fetched by the install script; you’re only asked if that didn’t happen.
4. Database — use the bundled Postgres appliance, or bring your own (you’ll be asked for a connection string).
5. Object storage — use the bundled MinIO appliance, or bring your own S3-compatible provider (endpoint, bucket, access key, secret key, region).
6. SMTP — host, port, username, password, and the “from” address for outbound email.

From there, orbit-setup does the rest with nothing left to fill in by hand:

• Generates every secret (Postgres/RabbitMQ/Grafana passwords, the JWT signing key, the update-service shared secret, your one-time deployment setup token) and writes them to .env next to the compose files.
• Exchanges your license for a short-lived registry token and logs Docker into the (private) container registry — no credentials to request or manage yourself.
• Pulls every image and brings the stack up (docker compose up -d).
• Waits for the instance to report healthy, then sets up the reverse proxy and TLS certificate for the domain you gave it.

Re-running the installer against an existing install directory reuses the secrets already in .env instead of generating new ones, so already-initialized services (like the database) aren’t broken by a re-run.

3. Finish setup in the browser

Once the installer finishes, it prints your instance’s bootstrap URL and a one-time setup token:

Finish setup at: https://orbit.example-corp.com/auth/bootstrap
Setup token (paste this into the bootstrap wizard): ...

Visit that URL, paste in the token, and create your first admin account. The bootstrap page is only reachable until the first account exists — after that, /auth/bootstrap is disabled, so set this token before the instance is reachable from outside your own network, not after.

A self-hosted instance is pinned to a single tenant: there’s no public registration page and no cross-tenant/System Admin surface, unlike Orbit Cloud’s multi-tenant setup — /auth/bootstrap is the only way to create the first (and only) account.

Next: Configuration to see every .env variable in detail, or Updates & licensing for what happens after day one.