Install Server

Installation Steps

Step 1 - Install Software (get scripts → validate → install)

Step 2 - Setup Host Firewall

Step 3 - Public Access (NAT)

Step 4 - Login To Portal & Set General Settings

Step 5 - Manage Breakglass (root) Password

Next Step - Common Configuration & Hardening

Requirements

Pre-flight checks (hostname, ports, disk, Docker, timezone, swap, portal root password) are done by validate-install.sh — do not run them by hand.

Install Software

1. Get the scripts

git clone https://github.com/mamori-io/mamori-server-scripts.git
cd mamori-server-scripts/media

2. Run validate

bash validate-install.sh

On Red Hat / Podman:

DOCKER='sudo podman' bash validate-install.sh

3. Run install

bash install-dockehub.sh

bash install-redhat-dockerhub.sh

# Place mamori_mon_docker.tgz in the current directory first
bash install-file.sh

Log in with the portal root password you set during validate. There is no default password.

Upgrade

cd mamori-server-scripts/media
bash upgrade-dockerhub.sh
# or, with a local tarball: bash upgrade-file.sh

Setup Host Firewall

Configure the server firewall (Ubuntu ufw or Red Hat firewalld). The script always opens SSH (22) and HTTPS (443), and asks whether to enable WireGuard, DB proxies, RDP, and the WEB proxy.

When WireGuard is enabled, clients on the WireGuard CIDR (default 172.0.0.0/16) are allowed to all host ports—including DB proxies, RDP (4822), and the WEB proxy (8089)—without opening those ports to the public internet. If you choose to open any of those ports to any source, the script asks whether the server is internet-exposed and requires an extra confirm before applying.

cd mamori-server-scripts/firewall
bash setup-firewall.sh
bash validate-firewall.sh

Non-interactive examples:

# WireGuard only (recommended for remote DB / RDP / WEB proxy clients)
bash setup-firewall.sh --wireguard --wg-cidr 172.0.0.0/16 --no-prompt

# Private / non-internet host: open optional ports to any source on the LAN
bash setup-firewall.sh --db-proxies --rdp --web-proxy --no-prompt

# Internet-facing + public optional ports (discouraged; requires --*-public)
bash setup-firewall.sh --db-proxies --rdp --web-proxy \
  --internet-exposed --db-public --rdp-public --web-public --no-prompt

bash validate-firewall.sh

Public Access (NAT)

On your edge router / cloud security group, forward only what you use:

Remote web portal access

Do you have a unique public IP for the Mamori server?

Yes - Forward port 443 to 443 of the internal IP of the Mamori server.

No - Forward port 1443 or another port to 443 of the internal IP of the Mamori server.

Remote IP resource access (WireGuard)

If WireGuard was enabled in setup-firewall.sh:

• Forward UDP 51871 to the Mamori server.

Do not NAT or open DB/SSH proxy ports (5432, 1433, 3306, …), RDP (4822), or the WEB proxy (8089) to the internet. WireGuard clients reach those ports on the Mamori host via the client-network allow after connecting to WireGuard.

Remote HTTP/S proxy access

Prefer WireGuard for remote WEB proxy clients. Only forward TCP 8089 if you intentionally opened the WEB proxy publicly (private LAN, or --web-public on an internet-facing host).

Enable Mamori mobile push notifications

The Mamori mobile app requires access to the Mamori server via HTTPS.

This access will automatically be available for configurations that provide remote web portal access. However, for configurations that do not, such as "Air Gap" environments, then do the following :

• In Server Settings > General set the server public IP address to the internal IP
• In Server Settings > Authentication Providers -> pushmobile set the url to the public IP and port.
• Forward Public 443 or 1443 to a server with Nginx
• From the relay Nginx server route /websocket to the Mamori server. Deny all other traffic.
• Define a Mamori connection policy that blocks all external IP addresses that are not the Mamori mobile app.

Login to confirm access

Login

Login to the Mamori portal with the portal root password you set during validate

url : https://[mamori server ip address]

username : root password : (the password you entered when running validate-install.sh)

Set General Server Settings

To set the general Mamori server properties

Click Server Settings >

Click General

Next, enter details

Field	Description
Public IP Address	The IP or DNS name users will use to access the Mamori server If a custom port is being used, then enter SERVER:PORT If internal access only, then enter the internal IP
Log Retention Period	Period to keep detailed logs
Modules Menus	Enable/Disable the features that will be used

Manage breakglass (root) password

The portal root account is your breakglass login: the recovery identity when other admin accounts or MFA are unavailable. You chose this password during validate-install.sh; there is no default.

Record the secret

After a successful install, confirm the host bootstrap file is gone (install scripts remove it after first boot):

rm -f mamori-server-scripts/.mamori-root-password.env if it still exists

Save the same password in your key store under a clear name (for example mamori/<hostname>/root).

Change the root password (portal)

Click Server Settings > Authentication Providers

Click for the admin provider

Set Password to the new root password

Click Update

Update the value in your key store immediately

Optional: dedicated day-to-day administrators

Keep root for breakglass only. Create normal administrator users for daily work, enable MFA, and use those accounts for operations. Use root when recovering access.

Click Users →

Enter login id, email, and password; select an administrator profile → Create

Helpful Scripts

Upgrade Clean Up Script

Removes backup Mamori containers and images left after an upgrade (mamori-<timestamp> containers, mamori-old / similar image tags).

cd mamori-server-scripts/media
bash cleanup.sh

Uninstall

Removes the Mamori containers and images. By default also deletes Mamori Docker volumes (data). Use --keep-volumes to preserve data volumes.

From mamori-server-scripts/media:

bash uninstall.sh
# or keep volumes:
bash uninstall.sh --keep-volumes