Auto-installation on DigitalOcean

DigitalOcean is the fastest way to get a production Track Arrow server. The official startup script installs Docker, MySQL, Redis, ClickHouse, the API, and the admin panel on first boot.

Recommended Droplet

Image: Ubuntu 24.04 LTS (or 22.04 LTS)
Plan: 2 vCPU · 4 GB RAM · ~120 GB disk (Basic, about $32/mo)
Datacenter close to your traffic geo

WARNING

Do not use 1 GB or 2 GB Droplets. ClickHouse and MySQL will run out of memory.

Create the Droplet

Sign in at digitalocean.com and click Create → Droplets.
Choose Ubuntu 24.04, the recommended size, and a region.
Under Additional Options, enable Startup scripts (user data).
Paste the Track Arrow startup script. You can copy it later from Settings → Install in an existing tracker, or from your Track Arrow account.
Before create, set GITHUB_USERNAME, GITHUB_TOKEN, and optionally DOMAIN (A record → Droplet IP) plus LETSENCRYPT_EMAIL for automatic HTTPS.
Add your SSH key and click Create Droplet. First boot takes about 5–15 minutes.

TIP

If you set DOMAIN, point the A record to the Droplet IP before or immediately after create. Caddy will request a free Let’s Encrypt certificate.

After installation

SSH into the Droplet and read the credentials file:

cat /root/trackarrow-credentials.txt

Open the admin URL from that file (or http://YOUR_DROPLET_IP/ if no domain). Then continue with Step 2. Create an administrator.

Install log: /var/log/trackarrow-install.log.

Cloud Firewall

Create a firewall right after the Droplet is up. This is required, not optional. Docker can bypass UFW on the Droplet, so a DigitalOcean Cloud Firewall is the reliable way to hide Redis and the other databases.

In DigitalOcean open Networking → Firewalls → Create Firewall.
Set inbound rules as in the table below. Do not add Redis 6379, MySQL 3306, ClickHouse, or Adminer.
Leave the default outbound rules unchanged (ICMP + all TCP + all UDP). Track Arrow needs outbound for DNS, Let’s Encrypt, GitHub, Docker pulls, the license API, and affiliate postbacks.
Apply the firewall to this Droplet.

Inbound (allow only these)

Type	Protocol	Port	Sources
SSH	TCP	22	All IPv4 (add All IPv6 if you SSH over IPv6)
HTTP	TCP	80	All IPv4, All IPv6
HTTPS	TCP	443	All IPv4, All IPv6

Outbound (keep DigitalOcean defaults)

Type	Protocol	Port	Destinations
ICMP	ICMP	—	All IPv4, All IPv6
All TCP	TCP	All ports	All IPv4, All IPv6
All UDP	UDP	All ports	All IPv4, All IPv6

WARNING

Do not restrict outbound. If you remove “All TCP / All UDP”, updates, certificates, and postbacks will fail. The Redis warning from DigitalOcean is about inbound port 6379, not outbound.

TIP

From your computer (macOS has no telnet by default) check that Redis is closed: nc -vz -w 3 YOUR_DROPLET_IP 6379. You want connection refused or timed out.