PureFusionOSDocumentation

PRODUCTION KNOWLEDGE BASE

Install it correctly.
Keep it healthy.

Follow this guide in order from an empty supported machine to a maintained PureFusionOS node. Do not add customers until first-run acceptance passes.

Build downloads are temporarily paused.Approved builds remain listed with checksums and signatures while product changes are completed.View build status
PRODUCTIONUbuntu ServerNative amd64 installation →PRODUCTIONVirtualBox appliancePrebuilt OVA import →PREVIEWWindows installerVirtualBox-hosted setup →
01
BEFORE INSTALLATION

Prepare the machine and operating record

Use a dedicated machine or VM.Do not install over another control panel or a server already hosting unrelated production services.
PathSupported baseStatus
Ubuntu ServerUbuntu 22.04 or 24.04, amd64Production
VirtualBox OVA4 vCPU, 6 GiB RAM, 100 GiB expanding diskProduction
Windows installerWindows 10/11 or Server 2016+, 8 GiB RAM, 110 GiB freePreview

Record before starting

  • Stable public IP and intended server hostname
  • Administrative control of the DNS zone
  • Off-machine recovery destination
  • Administrator and customer email addresses
  • A maintenance window for installation and validation
02
UBUNTU SERVER

Install the signed network bootstrap

Use these steps after downloads reopen.Obtain the DEB, checksum, and detached signature only from the PureFusionOS Builds page.

  1. Confirm the supported operating system

    lsb_release -ds
uname -m

    Continue only for Ubuntu 22.04 or 24.04 with x86_64.

  2. Verify the downloaded digest

    sha256sum -c PureFusionOS-Ubuntu-1.12.83-amd64.deb.sha256

    The result must end with OK. Stop on any mismatch.

  3. Install the bootstrap package

    sudo apt install ./PureFusionOS-Ubuntu-1.12.83-amd64.deb

  4. Run the verified installer

    sudo purefusionos-install

    The bootstrap pins the release key, verifies signed channel metadata, checks the payload digest and detached signature, then executes the platform installer.

  5. Keep the session open

    If the connection drops, preserve and inspect /var/lib/purefusion-installer/install.log. The installer records stage checkpoints.

03
VIRTUALBOX APPLIANCE

Import the production OVA

  1. Verify the OVA digest and signature

    Keep the OVA, checksum, and signature together and stop if validation fails.

  2. Choose File → Import Appliance

    Import the OVA; do not attach it as an arbitrary existing disk.

  3. Keep the resource floor

    Use at least 4 vCPU, 6 GiB RAM, and the 100 GiB expanding virtual disk.

  4. Record the access address

    The appliance uses DHCP. With NAT, use the forwarding address and port shown by the setup workflow.

04
WINDOWS PREVIEW

Use the graphical path for evaluation

The Windows installer is an unsigned Preview.Windows can show an unknown-publisher warning. Verify the published checksum and detached signature before continuing.

  1. Install Oracle VirtualBox first

    Enable hardware virtualization and confirm at least 110 GiB of free host disk.

  2. Run the verified Preview installer

    It deploys the same VirtualBox-hosted PureFusionOS appliance; it is not a Windows-native control plane.

  3. Save the forwarding address

    Use the address and port printed by the installer for first-run setup.

05
FIRST-RUN ACCEPTANCE

Validate before adding customers

  1. Open the exact address printed by setup

    Confirm the node identity before entering the one-time setup token.

  2. Create the primary administrator

    Use a unique password, enroll MFA, and store recovery codes offline.

  3. Confirm activation

    New nodes receive a 30-day management trial. Hosted services remain online after expiry, but changes lock until a valid signed license is installed.

  4. Complete acceptance

    • Health is 100%, or every exception has a documented incident
    • Diagnostics has no failed modules
    • DNS live query and zone file agree
    • SSL inventory and certificate inspection agree
    • Mail, database, backup root, and update channel are healthy
    • Administrator, customer portal, and storage sign-in paths open
06
ROUTINE OPERATIONS

Use a repeatable maintenance schedule

DAILY

Current state

  • Health and incidents
  • Core service state
  • Failed jobs and backup age
  • Disk and certificate warnings
WEEKLY

Recoverability

  • Inspect newest artifacts
  • Verify a backup is readable
  • Review privileged activity
  • Resolve update and DNS drift
MONTHLY

Exercise

  • Perform a restore drill
  • Review administrators and MFA
  • Test customer access
  • Review retention and capacity
07
BACKUP + RECOVERY

Prove recovery before it is urgent

  1. Identify the exact account, site, and artifact

    Never restore based on a filename alone.

  2. Verify readability and integrity

    Record the artifact, digest, operator, time, and verification result.

  3. Create a safety point

    Stop if the current target cannot be protected before replacement.

  4. Validate the restored workload

    Check ownership, database access, nginx, local HTTP, DNS, TLS, and customer access.

08
UPDATES

Use Update Manager, not manual replacement

  1. Confirm version, channel, digest, and signature

  2. Create and verify a current recovery point

  3. Approve the controlled update

    Do not overwrite protected runtime files manually.

  4. Repeat first-run acceptance

    Rollback using the recorded recovery workflow if acceptance fails.

09
CUSTOMER OPERATIONS

Create every account in a safe order

  1. Create identity and package

    Use the customer’s real email and confirm active status.

  2. Add domain and supporting services

    Keep website, database, mailbox, DNS, and certificate inside the same account boundary.

  3. Verify the customer view

    Confirm the portal exposes only resources owned by that account.

  4. Create the first recovery point

    Finish before customer handoff or public DNS cutover.

10
MIGRATION

Discover, dry-run, checkpoint, then cut over

Check the supported scope before promising a panel-wide migration.The current controlled workflow proves website and database transfer. Complete cPanel, Plesk, and DirectAdmin account migration remains a product completion item.

  1. Prepare an active target account

  2. Pin the source SSH host fingerprint

  3. Inventory files, database, size, PHP, DNS, TLS, and collisions

  4. Dry-run and capture a target checkpoint with digest

  5. Transfer, verify locally, then authorize cutover

11
TROUBLESHOOTING

Start with the symptom and preserve evidence

SymptomFirst checkDo not do
Installer stoppedFind the last START/DONE stage in /var/lib/purefusion-installer/install.log.Do not delete installer state.
Portal unavailableCheck node address, HTTPS response, services, and DNS.Do not disable TLS or authentication.
DNS wrongCompare Live Query with the authoritative Zone File and validate it.Do not treat cached public DNS as the file on disk.
Certificate warningCompare inventory with Inspect and read the full Certbot result.Do not repeatedly force renewal.
Restore failedPreserve artifact, digest, safety point, error, and job/audit ID.Do not overwrite or delete evidence.
12
SUPPORT EVIDENCE

Send useful facts without sending secrets

Include

  • Build and node ID
  • Affected page and action
  • Timestamp with time zone
  • Job or audit ID
  • Exact error and expected result

Never include

  • Passwords or MFA recovery codes
  • API keys or setup tokens
  • Private signing or license material
  • Raw customer content or private keys

Search documentation