Guide contents1 of 9
Install the server
Your VPS, with automatic HTTPS or behind the nginx you already have.
Before you start
- DNS: an A record for
tunnels.midominio.comand another for*.tunnels.midominio.comto the VPS IP. - Ports: TCP 443 free (LnkStart takes it), and 80 free or on a proxy that passes it LnkStart's names.
setuplooks at what is there before touching anything and says which way to go. - Optional, faster: UDP 443 open on the firewall, for QUIC.
- Recommended: an NS record for
_acme-challenge.tunnels.midominio.compointing tolnk.tunnels.midominio.com, and port 53 (UDP and TCP) open. That gives one certificate for every name.
What is already on the VPS decides the way. setup looks before touching anything and tells you:
| Type | What is on the VPS | What setup does | Go to |
|---|---|---|---|
| A | Nothing on 80 or 443 | Takes both. Automatic HTTPS | Normal installation |
| B | nginx, Traefik, Caddy or Apache with websites on 443 | Stops without touching anything, says which sites there are and the two ways | Behind a proxy you already have |
| C | Something only on 80: nginx's welcome page, apps on other ports | Takes 443 and gives you the block for that proxy to pass it port 80. Automatic HTTPS | Normal installation |
| D | No systemd: a container, WSL | Stops and points you to the manual install | Without systemd, or manually |
Normal installation: automatic HTTPS
On the VPS
curl -fsSL https://lnkstart.com/ install.sh | sudo sh -s -- server tunnels.midominio.com tu@correo.com
Checks the machine, ports and DNS; writes /etc/lnkstart/server.toml; registers the free license to that email; creates a system user, installs the systemd service and starts it; checks that lnk.tunnels.midominio.com really reaches this server, and finishes by printing the line for your first machine. When it ends, successfully or not, it sends an anonymous notice with the step it reached and how it finished (no domain, no email, no IP; see "What is sent").
The server itself requests each website's certificate from Let's Encrypt when you publish it, and renews it automatically. No need to run certbot. TCP and UDP services go through their port and need no certificate.
With one more record in your DNS, _acme-challenge.tunnels.midominio.com of type NS pointing to lnk.tunnels.midominio.com, and port 53 open (UDP and TCP), the server requests a single wildcard certificate for *.tunnels.midominio.com: a new name has HTTPS at once. That record only lets the server answer Let's Encrypt's check; it keeps no key of your DNS provider. Without it, each name gets its own. sudo lnkstart server tells you which one you have.
Every certificate is logged in public records (Certificate Transparency) that anyone can search, for example on crt.sh: the list of names under your domain is not secret, and the bots that read it visit a new name within minutes. If you publish for clients, use names that don't give them away (c1, demo-3) instead of their names, and protect anything that shouldn't be seen from the start ("Protect access"). With the wildcard (the _acme-challenge record) or your own ("Custom certificate"), no name shows up: only *.tunnels.midominio.com.
Agents come in through lnk.tunnels.midominio.com, which belongs only to the server; no service can be named lnk. Everything else is yours: tunnels.midominio.com for your website, and app.tunnels.midominio.com, api.tunnels.midominio.com or whatever you publish.
On the VPS
sudo systemctl status lnkstart-server sudo journalctl -u lnkstart-server -f
Status and log of what is happening.
On a new VPS, without logging in
When you create the VPS, most providers let you paste "user data" or "cloud-init" that runs on first boot (Hetzner, DigitalOcean, Vultr and Scaleway call it that). Paste this with your domain and email, create the VPS and add the two A records with its IP: the server waits up to an hour for the DNS to point to it, and installs itself.
user data (cloud-init)
#cloud-config runcmd: - curl -fsSL https://lnkstart.com/ install.sh | LNKSTART_WAIT_DNS=60 sh -s -- server tunnels.midominio.com tu@correo.com
On the VPS, once done
sudo grep 'join LD1' /var/ log/ cloud-init-output.log
Your first machine's line stays in the first-boot log, which only the VPS administrators can read. If the hour went by without the DNS pointing here, the same log says what failed: fix it and run the normal installation again.
Behind a proxy you already have
Type B: if 443 is already nginx's, Traefik's or Caddy's with your websites, LnkStart goes behind it. There are two ways, and the first one keeps automatic HTTPS.
Without decrypting: the proxy looks at the name each visitor asks for and, if it belongs to tunnels.midominio.com, passes the encrypted connection through untouched, with the visitor's IP in a PROXY header. LnkStart keeps requesting and renewing its certificates, and everything else still goes to your sites.
On the VPS
curl -fsSL https://lnkstart.com/ install.sh | sudo sh -s -- server tunnels.midominio.com tu@correo.com --sni-proxy
When done, it prints the configuration for the proxy you are running, already with your names, and which of your sites must leave 443. Paste it, reload the proxy and press Enter: setup restarts LnkStart so it requests its certificates and checks that traffic reaches it. With nobody in front (cloud-init), restart it yourself with sudo systemctl restart lnkstart-server.
| Proxy | What it needs |
|---|---|
| nginx | The stream module (on Debian and Ubuntu, libnginx-mod-stream). Your HTTPS sites leave 443 and move to 127.0.0.1:8443. |
| Traefik | Version 3.5.2 or later. In Docker, the host's address instead of 127.0.0.1. |
| Caddy | Built with the layer4 module (xcaddy build --with github.com/mholt/caddy-l4). |
| Nginx Proxy Manager | It cannot route by name without decrypting: use the second way. |
With nginx, the stream block takes 443: every listen 443 in your sites moves to 127.0.0.1:8443. If one is left, nginx does not start, and a reload keeps the old configuration without saying so: nginx -t does not see it (the reason is in /var/log/nginx/error.log). Check it with sudo lnkstart server, which says whether lnk.<domain> reaches LnkStart. And certbot --nginx writes listen 443 ssl back each time it installs a site's certificate: move it to 127.0.0.1:8443 again afterwards.
LnkStart's local port only answers with the PROXY header in front: without it, there is no telling whose connection it is. To test it by hand, curl --haproxy-protocol.
Decrypting at the proxy: if your proxy cannot route without decrypting, LnkStart listens in plain HTTP on a local port and the proxy forwards traffic to it. The certificate becomes your responsibility (the wildcard needs DNS-01, or a per-name certificate).
On the VPS
curl -fsSL https://lnkstart.com/ install.sh | sudo sh -s -- server tunnels.midominio.com tu@correo.com --behind-proxy 127.0.0.1:20002
When done, it prints the nginx block you need to paste, already with your names.
The block includes the Upgrade header: without it, agents cannot connect over WebSocket and your apps' WebSockets do not work either.
Custom certificate
With a wildcard you already bought or emit via DNS-01, LnkStart can keep port 443 and use your certificate. Edit the config and restart.
/etc/lnkstart/server.toml
[tls] mode = "manual" cert = "/etc/ ssl/ mydomain/ fullchain.pem" key = "/ etc/ ssl/ mydomain/ privkey.pem"
On the VPS
sudo systemctl restart lnkstart-server
Browser console
Your server comes with a web console: from it you add, approve and revoke machines, protect services with a password or a token, change domains, ports and the license, and see who made each change. It lives on your server, so nothing it shows reaches us, and you do not sign in with your lnkstart.com account: it has its own administrators. setup asks whether to turn it on; otherwise, one command does it.
On the VPS
sudo lnkstart server admin enable
The running server turns it on by itself within seconds, without restarting, and you get a single-use link good for 10 minutes. With it you create your user: a password and a code from an authenticator app on your phone. From then on you sign in with them; you invite other administrators (up to 3) from the console, and each one sets their own password and app. The link still works if you lose your phone.
To make the console exist only from your networks, add --allow with them. Another link later: sudo lnkstart server admin link. To turn it off: sudo lnkstart server admin disable.
On the VPS
sudo lnkstart server admin enable --allow 203.0.113.7/32
Alerts: under «Settings → Alerts» you set a webhook (Slack, Discord, Mattermost, n8n…), a Telegram bot or your own mail server, and the server alerts you on its own when a machine or a service's app stays down for a few minutes, when a certificate is about to expire or fails, and when the license is about to expire. Once when it falls and once when it is back; also when a new machine waits for your approval and when a forced fix installs on its own. With a button to send a test. It goes from your server to wherever you say, never to us.
Without systemd, or manually
On the VPS
sudo lnkstart server init --domain tunnels.midominio.com sudo lnkstart server register --email tu@correo.com sudo lnkstart server run
init writes the config, register requests the license and run starts the server in the foreground.
On the VPS
lnkstart service systemd --server -- server run
Prints the systemd unit in case you want to install it yourself.
Firewall ports
| Port | For what | Required? |
|---|---|---|
| TCP 443 | Visitors and agents | Yes |
| TCP 80 | Let's Encrypt certificates and HTTPS redirect | Yes in auto mode |
| UDP 443 | QUIC: faster agent connection | No, but it shows |
| UDP and TCP 53 | The wildcard certificate (the _acme-challenge record) | No: without it, one certificate per name |
| TCP range | Public TCP services (SSH, databases…) | Only if you use them |
| UDP range | Public UDP services (VoIP, games…) | Only if you use them |
Backup and moving to another VPS
If the VPS dies, you rebuild it on another in a few minutes. Keep a backup now and then (one file encrypted with your password: machines, services, certificates, license, console and alerts), off the server:
On the VPS
sudo lnkstart server backup
On the new VPS, install lnkstart (the binary only), copy the file there and restore it; then the usual setup, which keeps that configuration and its license. Point your domain's DNS at the new VPS and your machines reconnect on their own, with the same code.
On the new VPS
sudo lnkstart server restore lnkstart-backup.lnkbak sudo lnkstart server setup tunnels.midominio.com you@email.com
Remove it from the server
On the VPS
sudo systemctl disable --now lnkstart-server lnkstart-update.timer sudo rm /etc/ systemd/ system/ lnkstart-server.service / etc/ systemd/ system/ lnkstart-update.* sudo systemctl daemon-reload sudo rm -r / etc/ lnkstart / var/ lib/ lnkstart sudo userdel lnkstart sudo rm / usr/ local/ bin/ lnkstart
Stops the server and removes the service, the forced-fix timer, the configuration, the data, its system user and the binary.
/var/lib/lnkstart holds the license, the joined machines, each service's protection and the certificates. If you are moving to another VPS with the same domain, make a backup first (sudo lnkstart server backup, under «Backup and moving to another VPS»): with it, your machines get back in without joining again.
The license stays in your account as a server that no longer reports in; there is nothing else to do. The DNS records for tunnels.midominio.com are yours to remove at your provider.