Run nightshipd bare-metal (systemd)

The same server without Docker: a hardened systemd service, with Caddy in front for automatic HTTPS. The example uses Ubuntu 24.04.

1. Get the binary

The Linux server binary lives inside the official image — pull it out with docker cp and drop it at /opt/nightship/bin/nightshipd:

docker pull ghcr.io/nightship-io/nightshipd:latest
docker create --name nightshipd-extract ghcr.io/nightship-io/nightshipd:latest
docker cp nightshipd-extract:/usr/local/bin/nightshipd ./nightshipd
docker rm nightshipd-extract
sudo mkdir -p /opt/nightship/bin
sudo mv nightshipd /opt/nightship/bin/nightshipd
sudo chmod +x /opt/nightship/bin/nightshipd

2. Data directory and a dedicated user

sudo useradd --system --no-create-home --shell /usr/sbin/nologin nightship
sudo mkdir -p /var/lib/nightship
sudo chown nightship:nightship /var/lib/nightship
sudo chmod 700 /var/lib/nightship

3. systemd service

Create /etc/systemd/system/nightshipd.service:

[Unit]
Description=Nightship build server
After=network.target

[Service]
User=nightship
Group=nightship
ExecStart=/opt/nightship/bin/nightshipd --data-dir /var/lib/nightship --port 8080
WorkingDirectory=/var/lib/nightship
Restart=on-failure
UMask=0077
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectControlGroups=yes
RestrictSUIDSGID=yes
LockPersonality=yes
ReadWritePaths=/var/lib/nightship

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now nightshipd
sudo systemctl status nightshipd

4. HTTPS and firewall

nightshipd serves plain HTTP on 127.0.0.1:8080; put Caddy in front for automatic TLS, and open only the ports you need. The full Caddyfile, ACME notes, and ufw rules are in Terminate TLS with a reverse proxy (Caddy).

5. Bootstrap the first admin

The offline subcommands operate directly on the data directory, so run them as the nightship user:

sudo -u nightship /opt/nightship/bin/nightshipd user create admin \
  --role admin --data-dir /var/lib/nightship
sudo -u nightship /opt/nightship/bin/nightshipd token create bootstrap \
  --user admin --data-dir /var/lib/nightship

Copy the printed token — it is shown only once. You now have an admin credential for https://builds.example.com. See Bootstrap the first admin for the full picture, and Security and hardening for the production checklist.

← All guides