Installing on a VPS

The most common case: a VPS at the hosting provider of your choice (OVH, Scaleway, Hetzner, Ionos…), installed with the provider’s standard Debian 13 template. One command installs Kanadr on it; at the end, the machine is in the same state as a VM made from the image after its first boot.

The VPS

Debian 13 (trixie), amd64, the provider’s template as is, with no other software;
at least 2 vCPUs, 4 GB of memory and 20 GB free (see Sizing);
a public IPv4 address and SSH access (root, or an account with sudo, with the key the provider installed);
a fully qualified name for the machine (pbx.operator.example), with its DNS record (A) pointing to the VPS address: preferably before installing, otherwise before the Certificate step of the wizard.

In one command

Connected to the VPS over SSH:

curl -fsSL https://apt.kanadr.com/installer.sh | sudo bash -s -- --nom pbx.operator.example

Allow 10 to 20 minutes. The installer:

checks the machine (below) and stops at once if it is not suitable, before changing anything;
gives the machine its name (hostname, /etc/hosts), and keeps it across reboots if the provider installed cloud-init;
declares the (signed) update repository;
downloads the telephony engine and the installation files, from the same build as the image, and checks their SHA-256 checksums;
performs the same installation as the image: Debian packages, telephony engine, Kanadr, nginx, speech synthesis;
runs the first boot: secrets specific to the machine, database, telephony engine settings, recordings volume, services (see First boot);
shows the setup link, under the name and under the IP address, the ports to open and the check command:

Kanadr est installé : pbx.operator.example (192.0.2.10)

Mise en route de Kanadr / Kanadr setup
Ouvrir / Open : https://pbx.operator.example/mise-en-route#…
…
Ou par l'adresse IP / Or by IP address :
  https://192.0.2.10/mise-en-route#…

Ports à ouvrir vers la machine (pare-feu de l'hébergeur) :
  443/tcp et 80/tcp              portail, API, certificat Let's Encrypt
…
Vérifier la machine : sudo kanadr verifier

Open the link, then follow the Quick start from step 3. The link is shown again at each SSH login; a new one: sudo kanadr mise-en-route.

The network, SSH, the accounts and the SSH key stay the provider’s: the installer does not touch them. To read the script before running it: curl -fsSLO https://apt.kanadr.com/installer.sh, then sudo bash installer.sh --nom ….

Option	For
`--nom`	Fully qualified name of the machine (mandatory): it gives the portal address and the default domain.
`--version`	A specific version (the latest by default; only the latest build is published).
`--sans-enregistrements`	No dedicated volume for call recordings (see below).
`--essai`	Checks the machine and shows the commands, without changing anything.
`--forcer`	Overrides insufficient resources or a machine already in use. Dangerous: what exists may stop working.

Checks

The installer refuses, with a message saying what to do:

without root or sudo;
outside Debian 13, or outside amd64;
below 2 vCPUs, 3.5 GB of memory or 20 GB free (--forcer to override);
on a machine already in use: Kanadr or a telephony engine present, PostgreSQL with databases, nginx configured, Apache, or another service on ports 80, 443, 5060, 5061 or 5080 (--forcer to override). It never breaks an existing server: reinstall the VPS with the Debian 13 template instead.

A name that does not resolve to the VPS yet does not block: a warning says so, and the link by IP address works without it.

Interruption, rerun

If the SSH connection drops or a step fails, run the same command again: the installation resumes where it was (under the same name), first boot included. The installation log is in /var/log/kanadr-installation.log, the first boot log in journalctl -u kanadr-premier-demarrage. For a long installation over a fragile connection, run it inside tmux or screen.

Run again on an installed machine, the command changes nothing and shows the setup link again.

Recordings volume

Call recordings go on their own volume (Recordings volume): an empty second disk, if there is one, otherwise a file of half the remaining space (50 GB at most; none below 2 GB). --sans-enregistrements: no dedicated volume, to create later with kanadr-volume-enregistrements creer.

Provider firewall: open the ports from Prerequisites (the OVH network firewall, for instance, is set in the customer area, per IP address).
DNS: the A record of the name to the VPS, and the wildcard record for the customer domains (*.pbx.operator.example).
Then the wizard: Let’s Encrypt certificate, emails, provider, first customer.

Limits

IPv6: not configured by the installer; the portal and SIP work over IPv4.
Address translation (VPS whose public address is not on the interface): the link is given under the private address; open it under the public address, and set the address announced by the telephony engine (sudo kanadr adresse-publique, see Prerequisites).
Active/passive: two VPSs on the same network, with an IP address that can move between them; few providers allow it (see Active/passive).
Disk enlarged at the provider: the system grows as its Debian template provides; the recordings volume, with kanadr-volume-enregistrements agrandir.

Kanadr operator guide