Self-host Mechon

MECHON_PANEL_URL, MECHON_NODE_TOKEN, MECHON_VERSION (optional), MECHON_DATA_DIR (optional), MECHON_DNS (optional), MECHON_LOG_LEVEL (optional)

Requirements

• Linux (amd64 or arm64) with systemd, and root access.
• Docker Engine, installed and running.
• losetup, mkfs.ext4, resize2fs and iptables. On Debian or Ubuntu: apt-get install -y util-linux e2fsprogs iptables.
• Outbound HTTPS to the panel's URL.

Add a node

1. In the panel, open Nodes, then Add node. Copy the node token; the panel shows it only once.
2. On the node, run:

curl -fsSL https://raw.githubusercontent.com/jub0t/mechon/main/scripts/install-agent.sh \
 | sudo MECHON_PANEL_URL=https://panel.example.com MECHON_NODE_TOKEN=paste-the-token sh

The script checks the host, downloads the latest release and verifies its checksum, installs /usr/local/bin/mechon-agent, writes /etc/mechon/agent.env (mode 0600) and starts the mechon-agent systemd unit. It does not install Docker for you. To pin a version, add MECHON_VERSION=v0.1.0. The optional settings MECHON_DATA_DIR, MECHON_DNS and MECHON_LOG_LEVEL are passed the same way.

MECHON_DATABASE_URL, MECHON_PUBLIC_URL, MECHON_SECRET_KEY, MECHON_DATA_DIR, MECHON_LISTEN, MECHON_TRUST_PROXY

1. Download the binary

Pick a version from the releases page.

VERSION=0.1.0                      # without the leading "v"
ARCH=amd64                         # or arm64
cd /tmp
curl -fsSLO https://github.com/jub0t/mechon/releases/download/v$VERSION/mechon_${VERSION}_linux_$ARCH.tar.gz
curl -fsSLO https://github.com/jub0t/mechon/releases/download/v$VERSION/checksums.txt
sha256sum --check --ignore-missing checksums.txt
tar -xzf mechon_${VERSION}_linux_$ARCH.tar.gz mechon
sudo install -m 0755 mechon /usr/local/bin/mechon

2. Create a system user and the database

The panel connects over the local Postgres socket as the mechon role, so there is no database password to manage.

sudo useradd --system --home-dir /var/lib/mechon-panel --shell /usr/sbin/nologin mechon
sudo -u postgres createuser mechon
sudo -u postgres createdb --owner mechon mechon

3. Write the config

Generate the secret key that encrypts bot secrets at rest:

mechon keygen

Create /etc/mechon/panel.env:

MECHON_DATABASE_URL=postgres:///mechon?host=/var/run/postgresql
MECHON_PUBLIC_URL=https://panel.example.com
MECHON_SECRET_KEY=paste-the-keygen-output-here
MECHON_DATA_DIR=/var/lib/mechon-panel
MECHON_LISTEN=127.0.0.1:8080
MECHON_TRUST_PROXY=true

Lock the file down:

sudo chown root:mechon /etc/mechon/panel.env
sudo chmod 0640 /etc/mechon/panel.env

4. Run it with systemd

Create /etc/systemd/system/mechon.service:

[Unit]
Description=Mechon panel
After=network-online.target postgresql.service
Wants=network-online.target

[Service]
User=mechon
Group=mechon
EnvironmentFile=/etc/mechon/panel.env
ExecStart=/usr/local/bin/mechon serve
StateDirectory=mechon-panel
Restart=always
RestartSec=3
NoNewPrivileges=true
ProtectSystem=strict
ProtectHome=true
PrivateTmp=true

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now mechon
journalctl -u mechon -f            # should end with "panel listening"

5. Put a reverse proxy in front

With Caddy, which fetches the TLS certificate itself, /etc/caddy/Caddyfile is:

panel.example.com {
	reverse_proxy 127.0.0.1:8080 {
		# Flush at once so live logs (SSE) and the agent WebSocket stream without delay.
		flush_interval -1
	}
}