# Rizoma WebPanel — Install & Update

## Prerequisite: mesh enrollment (enforced)

WebPanel is **mesh-bound**. The installer refuses to run on hosts without an
enrolled Rizoma Mesh agent (no agent → no `100.64.0.0/10` mesh IP → the panel
would be unreachable by design):

```
ERROR: Rizoma Mesh not detected on this host. ... Installation refused.
```

Enroll the host first, then re-run:

```bash
curl -fsSL https://repo.rizomarl.com/mesh/install.sh | sudo bash -s -- \
  --coordinator-url https://<coordinator>:8443 --token <enroll-token> --name <node-name>
```

## Docker runtime (required, auto-installed)

All deploy paths (projects, stacks, databases) end in containers — without a
Docker daemon the panel is a UI shell. The installer checks `docker info` and,
on Debian/Ubuntu, installs `docker-ce` automatically, adds the `webpanel` user
to the `docker` group, and verifies daemon access. Non-Debian hosts must
provide Docker manually. Opt out with `--skip-docker` (deployments will fail
until Docker is provided):

```bash
curl -fsSL https://repo.rizomarl.com/webpanel/install.sh | sudo bash -s -- --skip-docker
```

## Admin credentials (printed once, mesh-installer parity)

On fresh hosts (no database yet) the installer seeds the admin account and
prints the credentials once at the end — like the mesh installer's admin PIN.
Existing hosts keep their current admin untouched.

```bash
# non-interactive (CI / no TTY) — or omit to auto-generate a strong one:
curl -fsSL https://repo.rizomarl.com/webpanel/install.sh | sudo bash -s -- \
  --admin-user admin --admin-pass '<min-12-upper/lower/digit/symbol>'
# or via env: RIZOMA_WEBPANEL_ADMIN_USER / RIZOMA_WEBPANEL_ADMIN_PASS
```

Without `--admin-pass` (and no TTY to prompt) a fresh install refuses with a
clear error. Weak passwords are rejected up front — first boot would `log.Fatalf`
on them. Credentials land in `webpanel.env` (`0600`, `webpanel:webpanel`):

```
=============================================
  Rizoma WebPanel installed
  URL:      https://<mesh-ip>/
  Username: admin
  Password: ...
  Save these credentials — the password is not shown again.
=============================================
```

## One-line install (recommended)

```bash
curl -fsSL https://repo.rizomarl.com/webpanel/install.sh | sudo bash -s -- --channel stable
```

Pins a version:

```bash
curl -fsSL https://repo.rizomarl.com/webpanel/install.sh | sudo bash -s -- --version 0.2.0
```

What the installer does: verifies mesh enrollment via the agent loopback
status endpoint, detects `amd64`/`arm64`, downloads
`webpanel-<version>-linux-<arch>` + `SHA256SUMS` from
`https://repo.rizomarl.com/webpanel/<channel>/`, verifies the checksum
(and GPG `.sig` when present), backs up the current binary to
`webpanel.bak-<timestamp>`, installs to `/opt/rizoma/webpanel/bin/webpanel`
(`webpanel:webpanel`, `0755`), **auto-binds the panel to the detected mesh
identity** (`RIZOMA_WEBPANEL_BIND_IFACE=<mesh-ip>`,
`RIZOMA_WEBPANEL_MESH_PEER_ID`, `MESH_TLS_HOSTS`, `DNS_MESH_SUFFIXES` in
`webpanel.env` — existing values are preserved except bind/peer which follow
the live enrollment), installs the systemd unit, restarts
`rizoma-webpanel`, and health-checks the panel (loopback + all local IPs,
covering mesh-bound listeners).

Check for updates without installing:

```bash
curl -fsSL https://repo.rizomarl.com/webpanel/install.sh | sudo bash -s -- --check
```

## Manual install

```bash
# prerequisites: go 1.26+, node 20+, CGO for dev builds
make deps && make build            # dev binary ./webpanel (CGO)
make release-bin VERSION=0.2.0     # static ./webpanel-0.2.0-linux-<arch>
sudo useradd -r -s /usr/sbin/nologin webpanel   # if missing
sudo install -o webpanel -g webpanel -m 0755 webpanel-0.2.0-linux-amd64 /opt/rizoma/webpanel/bin/webpanel
sudo cp packaging/systemd/rizoma-webpanel.service /etc/systemd/system/
sudo systemctl daemon-reload && sudo systemctl enable --now rizoma-webpanel
```

First boot prints the admin password (or set `RIZOMA_WEBPANEL_ADMIN_USER` /
`RIZOMA_WEBPANEL_ADMIN_PASS` beforehand). Panel binds the mesh interface
(`RIZOMA_WEBPANEL_BIND_IFACE`, default `rizoma0`) on port 443 with mesh TLS.

## Update / rollback

* Update: re-run the installer (same channel or `--version`). The previous
  binary is kept as `webpanel.bak-<timestamp>` — restore it and
  `systemctl restart rizoma-webpanel` to roll back.
* The repo keeps the current + one previous release per arch (same policy as
  the mesh repo), so `install.sh --version <previous>` always works.

## Uninstall

```bash
sudo systemctl disable --now rizoma-webpanel
sudo rm /etc/systemd/system/rizoma-webpanel.service
sudo rm -rf /opt/rizoma/webpanel/bin
# data (SQLite, mail, backups) lives under /opt/rizoma/webpanel/data — keep or remove explicitly
```