[{"data":1,"prerenderedAt":211},["ShallowReactive",2],{"docs-navigation-en":3,"docs-search-en":22,"i-lucide:search":95,"i-lucide:sun":100,"i-lucide:menu":102,"i-lucide:chevron-down":104,"docs-en-/docs/installation":106,"i-lucide:copy":207,"i-lucide:link":209},[4,15],{"section":5,"items":6},"Getting started",[7,11],{"title":8,"path":9,"order":10},"Introduction","/docs",1,{"title":12,"path":13,"order":14},"Installation","/docs/installation",2,{"section":16,"items":17},"How it works",[18],{"title":19,"path":20,"order":21},"How it is built","/docs/architecture",3,[23,27,32,37,42,47,52,56,61,66,71,75,80,85,90],{"id":24,"title":19,"titles":25,"content":26,"level":10},"/en/docs/architecture",[],"The three processes on a Maran server, the contract between them, and the rules that decide what the root daemon is allowed to do. A Maran server runs exactly three processes. The split between them is the product's main design\ndecision, and most of the rules below follow from it.",{"id":28,"title":29,"titles":30,"content":31,"level":14},"/en/docs/architecture#the-three-processes","The three processes",[19],"ProcessRuns asHoldsmaran-apian unprivileged system userevery piece of business logic, and the only database connectionmaran-agentrootnothing — it is stateless, with no database and no configuration of its ownPostgreSQLits own userthe panel's data, on a unix socket with no TCP listener at all The panel never touches the system. The agent never decides anything. That is the whole shape: a\nprocess that knows what should happen has no privileges, and the process with privileges knows\nonly how to do a fixed list of things.",{"id":33,"title":34,"titles":35,"content":36,"level":14},"/en/docs/architecture#the-contract-between-them","The contract between them",[19],"They speak over a unix socket, and what travels is a named operation with typed, validated\narguments. Three properties follow, and each is a rule rather than a habit: There is no operation that runs a caller-supplied program. Not a restricted one, not a\nwhitelisted one — none. So the set of things the root process can be made to do is finite,\nwritten down, and reviewable.There is no shell string anywhere in the exchange. A domain is not escaped before it reaches\na configuration file; it is validated as a domain — letters, digits, hyphens and dots — so there\nis no newline in it to end one directive and begin another of the caller's choosing.The agent checks who is asking. Peer credentials on the socket are read before the operation\nis considered, so the daemon knows which process is on the other end rather than trusting what it\nis told.",{"id":38,"title":39,"titles":40,"content":41,"level":14},"/en/docs/architecture#writing-a-configuration-file","Writing a configuration file",[19],"Every privileged write follows the same order, and the order is the point: render into a temporary file;fsync;rename it into place atomically;have the service itself validate the result — nginx -t, not a regular expression of ours;reload;roll the file back if either the validation or the reload refuses. One bad render cannot take a server's other sites down, because the server's own parser is what\ndecides whether the render was good.",{"id":43,"title":44,"titles":45,"content":46,"level":14},"/en/docs/architecture#isolation-between-accounts","Isolation between accounts",[19],"An account is a real Linux user, with its own home directory and filesystem permissions.Its PHP runs in its own php-fpm pool under its own uid, and file operations run as that user\n— never as root.Tenant tables are scoped by account in the database, through query filters an automated test\nwalks the whole model to verify.A request for another account's resource answers 404, never 403, so an error never confirms\nthat a row exists.",{"id":48,"title":49,"titles":50,"content":51,"level":14},"/en/docs/architecture#what-is-deliberately-absent","What is deliberately absent",[19],"No message broker, no sidecar, no second daemon. Background work runs on durable queues stored in\nPostgreSQL, and installing Maran adds nothing to the server that is not in the table above — with\none exception an operator turns on themselves, the FTPS service. Paid modules do not change this either: they are C# modules that drive operations already compiled\ninto the open agent. The agent never loads external code, which is why a licence cannot\nintroduce a new privileged capability.",{"id":53,"title":8,"titles":54,"content":55,"level":10},"/en/docs",[],"What Maran is, the three processes a server runs, and what the one root daemon will and will not do — including why it takes no shell commands. Maran is a web hosting control panel for Linux servers. Install it on a server and manage websites,\nPHP versions, SSL certificates, databases, files, backups and the firewall from a browser, with a\nseparate cabinet for every hosting customer and an API a billing system can drive to create\naccounts automatically.",{"id":57,"title":58,"titles":59,"content":60,"level":14},"/en/docs#three-processes-and-only-one-of-them-is-root","Three processes, and only one of them is root",[8],"A Maran server runs exactly three processes, and the split between them is the product's main\ndesign decision: maran-api — the panel itself. It holds every piece of business logic and is the only thing\nthat touches the database. It runs as an unprivileged system user.maran-agent — the only root process. It is stateless, has no database and no configuration\nof its own, and it alone touches the web server, php-fpm, the database server, SSH and file\ntransfer, the scheduler, the firewall and certificates.PostgreSQL — reachable only from maran-api, over a unix socket, with no TCP listener at\nall. The panel asks the agent for named operations over a unix socket, with typed and validated\narguments. There is no operation that runs a caller-supplied program, and no shell string anywhere\nin the exchange: the set of things the root process can be made to do is finite, written down and\nreviewable.",{"id":62,"title":63,"titles":64,"content":65,"level":14},"/en/docs#what-a-hosting-account-is","What a hosting account is",[8],"A real Linux user, with its own home directory and filesystem permissions. Its PHP runs in its own\npool under its own uid, and file operations run under that uid too — never as root. Every table\nthat belongs to a tenant is scoped by account at the database level, and a request for another\naccount's resource answers 404 rather than 403, so an error never confirms that a row exists.",{"id":67,"title":68,"titles":69,"content":70,"level":14},"/en/docs#no-brokers-no-sidecars","No brokers, no sidecars",[8],"Background work runs on durable queues stored in PostgreSQL. Installing Maran does not add a\nmessage broker, a sidecar or a second daemon to the server.",{"id":72,"title":12,"titles":73,"content":74,"level":10},"/en/docs/installation",[],"Installing Maran on a fresh server, what the installer checks first, and how the first administrator is created. Install on a server you control, with root access, running one of the supported\nplatforms.",{"id":76,"title":77,"titles":78,"content":79,"level":14},"/en/docs/installation#run-the-installer","Run the installer",[12],"curl -sSL https://get.maran.innovayse.com | bash The installer verifies the system before changing anything: the distribution and its version\nagainst the supported matrix, the RAM and disk floors, the ports it needs, and free space on the\nbackup filesystem. It collects every failure before exiting, so you fix the whole list once instead\nof re-running the installer per problem. If the checks pass, it installs signed release artifacts, hardens the systemd units, and sets up\nthe pieces a hosting server needs — the web server, PostgreSQL for the panel's own data, the\ndatabase server for hosting accounts, file transfer, the firewall and the scheduler.",{"id":81,"title":82,"titles":83,"content":84,"level":14},"/en/docs/installation#the-first-administrator","The first administrator",[12],"When installation finishes, the installer prints a one-time link. Opening it in a browser is how\nthe first administrator account is created — nothing else can create it, and the link is consumed\nwhen it is used.",{"id":86,"title":87,"titles":88,"content":89,"level":14},"/en/docs/installation#after-the-first-sign-in","After the first sign-in",[12],"Turn on two-factor authentication, then create your first hosting account. An account is a real\nLinux user with its own home directory, its own php-fpm pool and the plan's disk quota; creating\none through the panel is what provisions it on the host.",{"id":91,"title":92,"titles":93,"content":94,"level":14},"/en/docs/installation#updates-and-rollback","Updates and rollback",[12],"Updates are signed and taken either from the panel or with the maran command line tool. An update\ntakes a database dump before it swaps anything, and maran rollback puts the previous version back\nwith that dump as the safety net. Security patches update automatically by default; that can be\nturned off. html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":99},0,24,false,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m21 21l-4.34-4.34\"/>\u003Ccircle cx=\"11\" cy=\"11\" r=\"8\"/>\u003C/g>",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":101},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Ccircle cx=\"12\" cy=\"12\" r=\"4\"/>\u003Cpath d=\"M12 2v2m0 16v2M4.93 4.93l1.41 1.41m11.32 11.32l1.41 1.41M2 12h2m16 0h2M6.34 17.66l-1.41 1.41M19.07 4.93l-1.41 1.41\"/>\u003C/g>",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":103},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5h16M4 12h16M4 19h16\"/>",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":105},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m6 9l6 6l6-6\"/>",{"doc":107,"isFallback":98},{"id":108,"title":12,"body":109,"description":199,"extension":200,"meta":201,"navigation":202,"order":14,"path":72,"section":5,"seo":203,"seoTitle":204,"stem":205,"__hash__":206},"docsEn/en/docs/installation.md",{"type":110,"value":111,"toc":193},"minimark",[112,122,126,159,162,165,168,170,173,175,178,189],[113,114,115,116,121],"p",{},"Install on a server you control, with root access, running one of the ",[117,118,120],"a",{"href":119},"/platforms","supported\nplatforms",".",[123,124,77],"h2",{"id":125},"run-the-installer",[127,128,133],"pre",{"className":129,"code":130,"language":131,"meta":132,"style":132},"language-bash shiki shiki-themes github-light github-dark","curl -sSL https://get.maran.innovayse.com | bash\n","bash","",[134,135,136],"code",{"__ignoreMap":132},[137,138,140,144,148,152,156],"span",{"class":139,"line":10},"line",[137,141,143],{"class":142},"sScJk","curl",[137,145,147],{"class":146},"sj4cs"," -sSL",[137,149,151],{"class":150},"sZZnC"," https://get.maran.innovayse.com",[137,153,155],{"class":154},"szBVR"," |",[137,157,158],{"class":142}," bash\n",[113,160,161],{},"The installer verifies the system before changing anything: the distribution and its version\nagainst the supported matrix, the RAM and disk floors, the ports it needs, and free space on the\nbackup filesystem. It collects every failure before exiting, so you fix the whole list once instead\nof re-running the installer per problem.",[113,163,164],{},"If the checks pass, it installs signed release artifacts, hardens the systemd units, and sets up\nthe pieces a hosting server needs — the web server, PostgreSQL for the panel's own data, the\ndatabase server for hosting accounts, file transfer, the firewall and the scheduler.",[123,166,82],{"id":167},"the-first-administrator",[113,169,84],{},[123,171,87],{"id":172},"after-the-first-sign-in",[113,174,89],{},[123,176,92],{"id":177},"updates-and-rollback",[113,179,180,181,184,185,188],{},"Updates are signed and taken either from the panel or with the ",[134,182,183],{},"maran"," command line tool. An update\ntakes a database dump before it swaps anything, and ",[134,186,187],{},"maran rollback"," puts the previous version back\nwith that dump as the safety net. Security patches update automatically by default; that can be\nturned off.",[190,191,192],"style",{},"html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":132,"searchDepth":14,"depth":14,"links":194},[195,196,197,198],{"id":125,"depth":14,"text":77},{"id":167,"depth":14,"text":82},{"id":172,"depth":14,"text":87},{"id":177,"depth":14,"text":92},"Installing Maran on a fresh server, what the installer checks first, and how the first administrator is created.","md",{},true,{"title":12,"description":199},"Install Maran on a Linux server","en/docs/installation","3CFJTzvghuFkfyFBPIgzxsLK7i0UDpHMYdiE37c55zo",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":208},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Crect width=\"14\" height=\"14\" x=\"8\" y=\"8\" rx=\"2\" ry=\"2\"/>\u003Cpath d=\"M4 16c-1.1 0-2-.9-2-2V4c0-1.1.9-2 2-2h10c1.1 0 2 .9 2 2\"/>\u003C/g>",{"left":96,"top":96,"width":97,"height":97,"rotate":96,"vFlip":98,"hFlip":98,"body":210},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71\"/>\u003Cpath d=\"M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71\"/>\u003C/g>",1790166392044]