Manual TLS or Reverse Proxy

Use this path when you manage certificates yourself or an existing reverse proxy owns public ingress. The installer generates secrets, configures the selected ingress mode, and starts Airlock.

Before starting, complete the host prerequisites.

Manual certificate

Use a certificate containing both your apex domain and its wildcard, such as example.com and *.example.com. Put the certificate and key in one directory with these names:

cert.pem
key.pem

Run the installer with manual TLS forced:

curl -fsSL https://raw.githubusercontent.com/airlockrun/airlock/v0.4.0/install.sh | bash -s -- --manual

Enter the public domain and the host directory containing the certificate files. The installer sets TLS_MODE=manual, mounts that directory read-only, publishes Caddy on ports 80 and 443, and asks whether to use bundled or external infrastructure.

Point the apex domain and wildcard DNS records at the host. Airlock uses the apex for the dashboard, wildcard subdomains for apps, and s3.DOMAIN for public object URLs.

Existing reverse proxy

Configure nginx, Traefik, or another proxy with a certificate covering the apex domain and wildcard. Then run:

curl -fsSL https://raw.githubusercontent.com/airlockrun/airlock/v0.4.0/install.sh | bash -s -- --proxy

Enter the public domain, Caddy’s loopback HTTP port, and the exact address or narrow CIDR of the ingress proxy. Airlock rejects wildcard trust ranges. The installer binds Caddy to 127.0.0.1 on the selected port and configures trusted forwarding headers.

Forward both the apex domain and wildcard subdomains to that loopback endpoint. The external proxy owns public ports and terminates TLS; Airlock’s Caddy accepts plaintext HTTP only from the local host.

--manual, --proxy, --cloudflared, and --local select different ingress modes and cannot be combined.

Activate Airlock

The installer waits for Airlock to become healthy, then prints the URL and activation code. To retrieve the code again from the generated checkout:

cd ~/airlock
docker compose up -d
docker compose exec airlock cat /var/lib/airlock/activation_code.txt

Continue with the activation guide to configure providers, defaults, and optional Telegram access.