All tutorials

Развернуть первый сервер за 5 минут

Полное пошаговое руководство: скачать, настроить и запустить сервер HashRelay на Linux.

The server is the public end of the tunnel. The installer downloads hr-server, writes /etc/hash-relay/server.toml, installs the web admin UI, and registers a service (systemd, or procd on OpenWrt).

What you need

  • A Linux host with a public IP. OpenWrt / iStoreOS is supported and is already root.
  • TCP 8555 for the TLS tunnel, UDP 9555 for QUIC, and TCP 8585 for the admin API and web UI. 8585 is the installer default; pass API_PORT if you want another port.

Install

Press Enter at each prompt to keep the default, or set the variables before the pipe to skip the questions.

bash
# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-server.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'
bash
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-server.sh | \
  env \
    TCP_PORT=8555 \
    QUIC_PORT=9555 \
    API_PORT=8585 \
    API_LISTEN=0.0.0.0 \
    sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo env "TCP_PORT=$TCP_PORT" "QUIC_PORT=$QUIC_PORT" "API_PORT=$API_PORT" "API_LISTEN=$API_LISTEN" sh; fi'
Defaults from the installer: listen 0.0.0.0, TCP 8555, QUIC 9555, API/Web 8585 on 0.0.0.0, SQLite at the data directory, and a random JWT secret. On systemd the binary is /opt/hash-relay/bin/hr-server and state is /var/lib/hash-relay. On OpenWrt the binary is /usr/bin/hr-server.

Open the admin UI

  1. Browse to http://YOUR_SERVER:8585.
  2. Sign in as admin / hash. The seeded account must change that password on first login.
  3. If the page does not load, confirm the service is up and that 8585/tcp is open.
bash
sudo systemctl status hash-relay-server
sudo journalctl -u hash-relay-server -f
sudo ufw allow 8555/tcp
sudo ufw allow 9555/udp
sudo ufw allow 8585/tcp
Leave 8555 and 9555 reachable by your farm. 8585 is the admin UI — put it behind a firewall or a reverse proxy if the host is on the public internet. API_LISTEN=127.0.0.1 keeps it local.