Requirements
Server
Section titled “Server”| Item | Requirement |
|---|---|
| Operating system | Debian 12 or newer. The installers stop with “Debian required” on any other distribution and with “Debian 12+ required” on an older Debian. |
| Access | root. The installer stops with “Run me as root.” otherwise. |
| CPU | x86_64 downloads pre-built programs. On any other CPU the installer compiles Hyperion on the server. |
| Free ports | 80, 443 and the panel port (8443 by default). The installer checks them before it installs anything. |
| Machine | A fresh server. The installer installs nginx, and postfix if the server has no /usr/sbin/sendmail. |
Compiling from source needs build tools, a Rust toolchain (the installer installs both) and memory. The installer’s own message says to allow 5 to 15 minutes. During an update, a build on a server with little free memory and no swap adds a temporary 4 GB swap file in /var/tmp and removes it afterwards, if that disk has more than 5 GB free.
Network access from the server
Section titled “Network access from the server”The server needs outbound HTTPS to:
github.comandraw.githubusercontent.com, for the Hyperion release, the source and wp-cli.packages.sury.org, for the PHP packages. The installer picks the repository that matches your Debian release (bookworm,trixieorforky, andbookwormfor any other name).- The Debian mirrors, for the packages it installs with apt.
acme-v02.api.letsencrypt.org, for certificates.sh.rustup.rs, only when it compiles from source.
If the server sends mail directly to recipients (the default), outbound TCP port 25 must not be blocked by your provider.
Ports Hyperion uses
Section titled “Ports Hyperion uses”You do not have to open every port. Open what your setup uses.
| Port | Used by | Open to |
|---|---|---|
| 80, 443 tcp, 443 udp | nginx: sites, certificate validation, HTTP/3 on udp | Everyone |
| 8443 tcp | The panel (the listen setting in /etc/hyperion/web.toml) |
The people who sign in |
| 8447 tcp | phpMyAdmin through the panel | The people who sign in |
| 9443 tcp | Master to worker requests (on workers) | The master only |
| 21 tcp and 40000-50000 tcp | FTP control port and passive data range, if FTP is installed | Your FTP users |
| 22 tcp | SSH | You |
| 53 udp and tcp | Master only, only if you turn on automatic wildcard renewal | Everyone |
The Firewall page in the panel can manage these as presets. If the panel’s firewall is not in use, open them in your own firewall.
- For the panel: an A or AAAA record for the panel name, such as
panel.example.com, pointing at the master. You can skip the panel name during setup and use the server’s IP address with a self-signed certificate, which makes browsers warn. - For every site: its domain pointing at the node that hosts it, before you request a certificate.
- Port 80 must be reachable from the internet while a certificate is requested.