Requirements (Operations Guide)

This document lists what the installer checks, what it opens and what you must prepare yourself.

Before you start

A server that you control with root access over SSH.
Your license key. It is shown in your account on the XtreamGo website and sent by e-mail.
Outbound internet access from the server.
Optional: a domain or subdomain that you can point at the server.

Operating system

Main server

The installer (install.sh) accepts Ubuntu only. It reads /etc/os-release and stops on any other system.

Check in `install.sh`	Result
`ID` is `ubuntu`	Accepted.
`ID_LIKE` contains the word `ubuntu` (Ubuntu based systems)	Accepted.
Anything else	Stops with `This script is designed for Ubuntu only! (Detected: <id>)`.
Major version below 18	Stops with `Ubuntu <version> is too old. Minimum supported version is 18.04 LTS.`

The installer supports Ubuntu 18.04, 20.04, 22.04 and 24.04. It does not block newer releases.

The installer is tested on plain Ubuntu. An Ubuntu based system passes the check, but its package sources can differ. Use plain Ubuntu where you can.

The installer must run as root. Otherwise it stops with This script must be run as root!.

Load balancer server

A load balancer is installed from the panel over SSH (see Add a load balancer server). The panel uses apt-get and systemctl on the target, so the target must be a Debian or Ubuntu system with systemd. Supported systems are Ubuntu 20.04, 22.04, 24.04 and Debian 11, 12.

CPU, RAM and disk

The installer does not check CPU, RAM or disk space. These facts help you size the server:

Fact	Where it is set
The image bundle download is about 520 MB compressed. It is unpacked in `/tmp` and loaded into Docker.	`install.sh`, `images/xtreamgo-bundle.tar.gz`
MariaDB starts with a 2 GB InnoDB buffer pool and a 512 MB log file size unless you set `DB_BUFFER_POOL` and `DB_LOG_FILE_SIZE`.	`docker-compose.yml`
MariaDB allows 2000 connections unless you set `DB_MAX_CONNECTIONS`.	`docker-compose.yml`
Each service keeps at most 5 log files of 50 MB.	`docker-compose.yml`
`MAX_CONCURRENT_STREAMS` is written as 100.	`install.sh`
`ffmpeg` is installed on the host of the main server and of every load balancer.	`install.sh`, agent installation from the panel

The Help Center on the website states a minimum of 2 vCPU, 4 GB RAM and 40 GB SSD. The installer does not enforce this figure. With the default 2 GB database buffer pool, a server with 4 GB RAM has little room left for the other services and for streaming. Plan for more memory, or lower DB_BUFFER_POOL in /home/xtreamgo/.env.production before heavy use.

Disk use grows with HLS segments, VOD files, catch-up recordings and backups. All of these live in Docker volumes under /var/lib/docker/volumes/.

Ports

Inbound on the main server

Port	Purpose	Opened by
22/tcp and every port your SSH service listens on	SSH.	`ufw allow` in `install.sh`
80/tcp	Admin panel, Xtream Codes API, streams, customer portal, certificate challenge.	`ufw allow 80/tcp`, published by the nginx container
443/tcp	HTTPS after you run `ssl-setup.sh`.	`ufw allow 443/tcp`, published by the nginx container
8080/tcp	Second HTTP port with the same routes as port 80. Published when you keep the default HTTP port 80.	Published by the nginx container
Your custom HTTP port	Published instead of 8080 when you enter a port other than 80 at the `HTTP Port [80]` prompt.	`ufw allow <port>/tcp`, published by the nginx container
1935/tcp	Opened in the firewall by the installer. No panel service listens on it.	`ufw allow 1935/tcp`
3306/tcp	Database. Bound to `127.0.0.1`. Reachable from registered load balancer IPs only, and only while at least one load balancer is registered.	`db_lb_access_sync.sh`

Important points:

The installer runs ufw --force enable. Before that it allows port 22 and every port that the SSH service listens on. It reads these ports from sshd -T and from the listening sockets of sshd. A custom SSH port stays open.
Docker publishes container ports through its own firewall chains. These rules bypass ufw. Ports 80, 443 and 8080 (or your custom port) are reachable as soon as the nginx container runs.
If your provider has a cloud firewall or security group, open the same ports there.
These ports listen on 127.0.0.1 only and must stay closed to the internet: 8000 (API), 3001 (admin interface), 3002 (customer portal), 3003 (customer website), 3306 (database).

Outbound from the main server

Destination	Purpose
`https://api.xtreamgo.io` (443)	License validation and activation, package download, update check.
`https://get.docker.com` and the Docker package servers	Docker installation when Docker is missing.
Docker Hub	`nginx:1.25-alpine`, `redis:7-alpine` and later `certbot/certbot:v2.11.0`.
`ifconfig.me` or `icanhazip.com`	Detection of the public IP address.
Ubuntu package mirrors	`apt-get update`, `apt-get upgrade` and package installation.
Let's Encrypt	Certificate issue and renewal, when you use `ssl-setup.sh`.

Inbound from the license server

Updates are delivered by the license server over SSH. It uses the server access details registered for your license: the ones you entered at purchase with the automatic setup, or the ones you registered later through XtreamGo support. Keep this SSH access valid. To change the registered details, contact XtreamGo support. See Updates and rollback.

Load balancers

Direction	Port	Purpose
Main server to load balancer	SSH port (22 by default)	Agent installation and agent updates.
Main server to load balancer	6661/tcp by default	Agent control API. Protected by an API key.
Load balancer to main server	3306/tcp	The agent reads and writes the panel database.
Load balancer to main server	HTTP port of the panel	Requests that the agent forwards to the panel.
Viewers to load balancer	80/tcp	Stream delivery through nginx on the load balancer.

DNS and domain

A domain is optional. The panel works on the IP address.
The installer asks Domain (optional, leave blank):. The value is only written into the panel URLs in CREDENTIALS.txt and into CORS_ORIGINS. The installer does not create DNS records and does not request a certificate.
For HTTPS you need an A record that points at the public IPv4 address of the server. See HTTPS and domain.

What the license covers

The panel reads these values from the license server and shows them on the License page:

License type and expiry date.
Maximum simultaneous connections and maximum streams. The value 0 means unlimited.
The paid modules that are active on the license.

The license is bound to the public IP address of the server that verifies it. A second server that uses the same key receives License is bound to a different server IP. A license can also be locked to the hardware of one server.

Load balancer servers do not receive a license key. Their agent is configured with a server ID and an API key that the panel generates.

To learn whether your plan limits the number of load balancers, ask XtreamGo support.

How to check it worked

Run these on the server before you install:

bash

. /etc/os-release && echo "$ID $VERSION_ID"
id -u
nproc
free -h
df -h / /var/lib
curl -sS -o /dev/null -w '%{http_code}\n' https://api.xtreamgo.io/install/SHA256SUMS
ss -ltnp | grep -E ':(80|443|8080|3306)\s'

Expected results: ubuntu with a version of 18.04 or higher, user ID 0, HTTP code 200, and no listener on ports 80, 443, 8080 or 3306.

If something goes wrong

Message	Meaning	Action
`This script must be run as root!`	The installer was started without root rights.	Run `sudo bash install.sh`.
`This script is designed for Ubuntu only!`	The system is not Ubuntu.	Reinstall the server with Ubuntu 22.04 or 24.04.
`Ubuntu <version> is too old. Minimum supported version is 18.04 LTS.`	The Ubuntu release is older than 18.04.	Use a newer release.
`Cannot reach license server. Check your internet connection.`	No answer from `api.xtreamgo.io` within 15 seconds.	Check outbound HTTPS and DNS on the server.
`Docker Compose not found!`	Docker is installed without the Compose plugin.	Install the `docker-compose-plugin` package, then run the installer again. No panel exists on the server at this point.