OpsAny Platform — Community Edition Deployment

---

OpsAny is deployed as containers with Docker on a single host by default. Deployment has three main stages: installing the dependency packages, deploying the PaaS services, and deploying the SaaS services. Engineers are encouraged to read the installation scripts to understand every detail and explore how OpsAny works.

Host Requirements

Community Edition can be deployed on a single virtual machine. For production we recommend 8 CPU cores and 16 GB of memory; size the data disk according to the number of managed servers — 100 hosts need roughly 500 GB of storage for a year of monitoring data.

Configuration	OS	Host spec	Notes
Trial	Ubuntu 24.04	4 vCPU, 8 GB, 20 GB data disk	Deploys only the basic operations platform, for evaluating features.
Production	Ubuntu 24.04	8 vCPU, 16 GB, 100 GB data disk	Adds Zabbix monitoring and the DevOps platform, for production use.

Quick Deployment

Tip

Before you start, a serious reminder: according to statistics from 2020 to 2025, following the official documentation strictly yields a 100% success rate — neither the documentation nor the scripts can be wrong. If an installation fails, uninstall it, read the documentation carefully, and try again — be patient. Of course, you can also simply walk away; life is short, and being happy matters most. The most common causes of failed deployments in recent years, up front:

• The host is not clean: MySQL, an old Docker version, or similar is already installed, causing port conflicts or failing the initialization checks.
• The iptables firewall was not disabled, so ports are unreachable.
• The configuration file was not edited correctly.
• Commands were pasted in bulk, so some of them never finished.
• After installation, the domain used to access the platform differs from the one in the configuration file.
• The domain name does not resolve (editing the hosts file does not help — the domain must really resolve, or use an IP address).
• Not enough memory: below the 8 GB minimum.
• Corporate network or security device restrictions make the network unreachable.
• The browser uses a proxy, or a proxy was added in front of OpsAny.
• Occasionally a slow virtual machine makes MySQL start slowly and stay in the checking state — replace the host.

Deploying the OpsAny PaaS Platform

1. Install Docker and the required packages. Ubuntu 24.04 is recommended.

Ubuntu 26.04

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).
- Open these ports on cloud hosts: 80, 443, 8020, 8011, 8012, 4505, 4506, 10051 (see the port table at the end).

1.2 Install Docker and the MySQL client

# Do not paste and run everything at once: some commands may fail silently.
# step 1: install the required system tools
sudo apt-get -y update
sudo apt-get -y install apt-transport-https ca-certificates curl software-properties-common
sudo apt-get -y install docker.io jq uuid wget git ntpsec-ntpdate mysql-client unzip
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

Ubuntu 24.04, 22.04, 18.04

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).
- Open these ports on cloud hosts: 80, 443, 8020, 8011, 8012, 4505, 4506, 10051 (see the port table at the end).

1.2 Install Docker and the MySQL client

# Do not paste and run everything at once: some commands may fail silently.
# step 1: install the required system tools
sudo apt-get -y update
sudo apt-get -y install apt-transport-https ca-certificates curl software-properties-common
# step 2: install the GPG key
curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/ubuntu/gpg | sudo apt-key add -
# step 3: add the repository
sudo add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/ubuntu $(lsb_release -cs) stable"
# step 4: update and install Docker CE
sudo apt-get -y update
sudo apt-get -y install docker-ce jq uuid wget git ntpdate mysql-client unzip
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

Debian

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# step 1: install the required system tools
sudo apt-get -y update
sudo apt-get install -y apt-transport-https ca-certificates curl gnupg2 software-properties-common

# step 2: install the GPG key
sudo curl -fsSL https://mirrors.aliyun.com/docker-ce/linux/debian/gpg | sudo apt-key add -

# step 3: add the repository
sudo add-apt-repository "deb [arch=amd64] https://mirrors.aliyun.com/docker-ce/linux/debian $(lsb_release -cs) stable"

# step 4: update and install Docker CE
sudo apt-get -y update
sudo apt-get -y install docker-ce docker-ce-cli containerd.io jq uuid wget git ntpdate mariadb-client unzip
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

AlmaLinux

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install Docker
dnf config-manager --add-repo=http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
dnf -y install docker-ce --nobest
systemctl enable --now docker

# Install the deployment dependencies
dnf -y install mariadb jq git uuid unzip wget
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

RockyLinux

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install Docker
dnf config-manager --add-repo=http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
dnf -y install docker-ce --nobest
systemctl enable --now docker

# Install the deployment dependencies
dnf -y install mariadb jq git uuid unzip wget
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

Anolis OS

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install the deployment dependencies
yum -y install docker mariadb jq git uuid unzip wget
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

OpenEuler, Huawei Cloud EulerOS

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install Docker and the dependencies
yum -y install docker mariadb jq git uuid unzip wget
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

OpenSUSE

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install Docker and the dependencies
zypper refresh
zypper install -y docker mariadb jq git uuid unzip wget
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

CentOS 7

• CentOS 7 reached end of life on 30 June 2024. Look for an alternative such as Ubuntu, AlmaLinux, or RockyLinux.

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Do not paste and run everything at once: some commands may fail silently.
curl -o /etc/yum.repos.d/epel.repo http://mirrors.aliyun.com/repo/epel-7.repo
curl -o /etc/yum.repos.d/docker-ce.repo https://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
yum install -y git uuid wget docker-ce mariadb jq ntpdate unzip
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
ntpdate time1.aliyun.com

CentOS 8

• CentOS 8 reached end of life on 31 December 2021. Look for an alternative such as Ubuntu, AlmaLinux, or RockyLinux.

1.1 Environment checks

- Make sure the host can reach the internet and has at least 8 GB of memory.
- Disable SELinux and the firewall, set a normalized hostname, and make sure the hostname resolves.
- OpsAny can be accessed by IP address; if you use a domain name, make sure it really resolves (editing hosts does not work).

1.2 Install Docker and the MySQL client

# Install Docker and the dependencies
dnf config-manager --add-repo=http://mirrors.aliyun.com/docker-ce/linux/centos/docker-ce.repo
dnf -y install docker-ce --nobest
dnf -y install mariadb jq git uuid unzip
systemctl enable --now docker
ln -sf /usr/share/zoneinfo/Asia/Shanghai /etc/localtime

1. Clone the PaaS code. PaaS is fully open source.

Gitee

cd /opt && git clone --depth=1 https://gitee.com/unixhot/opsany-paas.git

GitHub

cd /opt && git clone --depth=1 https://github.com/unixhot/opsany-paas.git

1. Edit the installation configuration (mandatory)

Danger

Attention! If you have no domain name, or the domain does not resolve, set an IP address instead. Editing the hosts file does not work, because every container must resolve that address. By default OpsAny PaaS and OpsAny Proxy are deployed on the same machine, so PROXY_LOCAL_IP and LOCAL_IP are identical. If the platform must manage internet hosts, set PROXY_PUBLIC_IP to the public IP address (or a domain name that really resolves — editing hosts does not work). For a local lab environment, set everything to the local IP address.

• Step 1: generate the configuration file from the template

# Copy the template to create the configuration file
cd /opt/opsany-paas/install && cp install.config.example install.config

• Step 2: edit the configuration file

During execution the script generates random strings and replaces INIT_PASSWORD in the configuration file. If you want custom passwords, simply set them.

vim /opt/opsany-paas/install/install.config
# The domain name used to access OpsAny. Without a domain, use a public or intranet IP address; editing hosts does not help. This must be changed! Custom ports are not supported.
DOMAIN_NAME=192.168.56.11

# The intranet IP address of the host where OpsAny is installed. Used for process binding, database initialization, and so on. This must be changed!
LOCAL_IP=192.168.56.11

# For public deployments, set the public IP address; for intranet deployments, the default is fine.
PROXY_PUBLIC_IP=192.168.56.11

1. Run the installation script to deploy PaaS

Make sure the configuration is correct before installing, otherwise the installation fails. If it fails, run ./uninstall.sh to uninstall and install again.

# No errors are allowed during the run; warnings can be ignored. This documentation is verified against the current release.
cd /opt/opsany-paas/install/
./paas-install.sh install

Pulling images can be slow — be patient. If the installation fails, run uninstall.sh and install again; the whole run must be error-free before you continue.

1. Test access to the domain. The default username is admin with password admin. Do not change the admin password before the SaaS applications are installed — change it after deployment completes.

2. URL: https://DOMAIN_NAME/ — note that you must access exactly the DOMAIN_NAME you configured. If the login page keeps reloading after you submit credentials, the URL you visited differs from DOMAIN_NAME.

Tip

At this point only the PaaS platform is deployed; no application is installed yet, so the console is empty. This is an open source operations PaaS development platform — if you are an operations developer, feel free to join our developer WeChat group; the entry point is in the floating widget on the official website.

Deploying the OpsAny SaaS Applications

Once the PaaS platform is reachable, you can deploy the SaaS applications. OpsAny Community Edition provides eight SaaS applications: Unified Permissions, Workbench, CMDB, Control Platform, Job Platform, Cloud Management, Monitoring, and Bastion Host. The Bastion Host is fully open source. The whole installation takes about 25 minutes; with enough bandwidth and fast image pulls, it can finish within 10 minutes.

1. Install OpsAny Community Edition.

Note: all WARNINGS during the installation can be ignored, but Error messages must be handled. Choose exactly one of the options below — do not run them multiple times.

Base modules only, no Zabbix

With 8 GB of memory or less, run the command below to install only the base modules (no Zabbix, no DevOps platform — suitable when you already run Zabbix).

cd /opt/opsany-paas/install/
./saas-ce-install.sh base

Operations platform only

With 16 GB of memory or more, run the command below to install only the digital operations platform (no DevOps platform — suitable when you do not have a monitoring platform yet).

cd /opt/opsany-paas/install/
./saas-ce-install.sh ops

Operations platform and DevOps platform

With 16 GB of memory or more, run the command below to install every module (both the operations platform and the DevOps platform — suitable when you need the full DevOps toolchain).

cd /opt/opsany-paas/install/
./saas-ce-install.sh all

1. Open the platform and complete the basic settings.

When the installation finishes, the console prints the URL and password. Use Chrome to open it.

• URL: https://$DOMAIN_NAME
• Username: admin

• Password: changed automatically after installation for security and printed at the end. It is also stored in $INSTALL_PATH/conf/.passwd_env.

• You can now start using OpsAny. We strongly recommend starting with the Quick Start guide, onboarding your resources first, and exploring other features afterwards.

• Quick Start

If you run into problems, check the FAQ first.

• FAQ

To replace the HTTPS certificate after deployment, follow these steps.

• Replace the HTTPS certificate

Run performance tuning before putting the platform into production.

• Performance tuning

Offline deployment is possible only after a successful online deployment.

• Offline deployment guide

If you want the DevOps features, upgrade the host to 8 vCPU and 16 GB of memory.

• DevOps platform deployment

• Configure the MCP Server for your AI agent (highly recommended)

Since v2.3.2, OpsAny deploys the opsany-mcp-server service automatically on port 8020 and generates the MCP configuration JSON.

1. Get the opsany-mcp-server configuration JSON

# cat /data/opsany/conf/opsany-paas/mcp-server/mcp.json
{
    "mcpServers": {
      "opsany-mcp-server": {
        "url": "http://119.3.172.93:8020/sse",
        "headers": {
          "username": "admin",
          "user-api-token": "Created on Workbench - Personal Settings - API Token",
          "mcp-auth-token": "3e34accb-3cfd-4850-8e18-115ca60cb0a3"
          }
      }
    }
}

1. Adjust the MCP configuration JSON

2. username: the OpsAny user to act as. Defaults to admin; always grant the minimum required permissions.

3. user-api-token: create it under Workbench → Personal Settings → API Token.

4. mcp-auth-token: must match the MCP service configuration file /data/opsany/conf/opsany-paas/mcp-server/config.yaml. It is set during installation and does not need to be changed.

5. Example: configure the MCP Server in OpenClaw

After editing the fields above, paste the JSON into the OpenClaw chat box together with this prompt:

"Please add this opsany-mcp-server for me. Based on its capabilities, create a complete Skill that calls this MCP server to interact with the OpsAny digital operations platform, enabling intelligent operations."

1. Example: configure the MCP Server in TRAE IDE

1) Open TRAE IDE 2) Go to Settings → MCP Servers 3) Click Add MCP Server Fill in the configuration:

{
    "name": "opsany-mcp-server",
    "url": "http://192.168.0.111:8020/sse",
    "headers": {
        "username": "username",
        "user-api-token": "Created on Workbench - Personal Settings - API Token",
        "mcp-auth-token": "7e84a67d-e97a-4986-a5c9-393837089c12"
  }
}

4) Click Save

1. Download the built-in documentation (optional)

cd /data/opsany/uploads/
wget https://opsany.oss-cn-beijing.aliyuncs.com/opsany-docs-v2.3.4.tar.gz
tar zxf opsany-docs-v2.3.4.tar.gz

Production Deployment Planning

The quick installation deploys MySQL, MongoDB, and Redis automatically. If your production environment already runs these services, you can reuse them by editing the relevant settings in install.config. OpsAny is designed to be distributed: the Community Edition deploys the OpsAny Proxy on the same host as the platform, but in a complex network you can deploy a standalone Proxy as described in the official documentation.

Intranet deployment, intranet access

Scenario: the platform is deployed in the intranet, manages only intranet hosts, and has no internet access.
Requirements:
- Managed intranet hosts must be able to reach ports 80, 443, 4505, 4506, 8011, 8012, and 10051 on the OpsAny platform. - Access by intranet IP address, or by intranet domain name if you have intranet DNS.

Intranet deployment, internet access

Scenario: the platform is deployed in the intranet and manages both intranet and internet hosts.
Requirements:

• The platform host needs a public IP address and domain name, and both the intranet and the internet must reach ports 80, 443, 4505, 4506, 8011, 8012, and 10051 on OpsAny. Configure the security group before deploying on a cloud host.
• Under Control Platform → Collection Center, set both the internet and intranet controller addresses. However, the platform URL can be only one of the three (domain name, public IP, intranet IP); mixed access is not supported for security reasons. A domain name is recommended.

Public deployment, internet access

Scenario: the platform is deployed on the internet and can manage intranet hosts (with a Proxy) as well as internet hosts.
Requirements:

• Configure the security group before deploying on a cloud host. Both the intranet and the internet must reach ports 80, 443, 4505, 4506, 8011, 8012, and 10051 on OpsAny.

Supported Platforms

Tested operating systems:

• All AlmaLinux versions
• All RockyLinux versions
• All CentOS 7.x versions
• All CentOS 8.x versions
• Ubuntu 16.04, 18.04, 20.04, 22.04
• UOS v20, v21, v22
• Kylin v10, v20, v30
• OpenEuler 20.03, 22.03, 23.03
• All OpenSUSE versions
• Other systems that have not been tested but are known to work

Supported browsers

• Google Chrome
• Microsoft Edge
• 360 Browser
• Firefox

Systems supported by Agent/SSH:

• CentOS 6.0 (SSH only), 7.x, 8.x
• Ubuntu 16.04, 18.04, 20.04, 22.04
• Debian 12.0.0, 11.1.0, 10.0.0, 9.0.0
• Windows Server 2012 and later
• AlmaLinux 8.3, 8.4, 9.0
• RockyLinux 8.4, 8.5, 9.0
• EulerOS 2.5
• UOS v20
• NeoKylin, Kylin
• Other systems that have not been tested but are known to work

Service and Port Reference

No.	Service	Listening port	Notes
Base services	OpenResty	80, 443, 8011, 8012	Web access
	MySQL	3306	Data storage
	MongoDB	27017	Document storage
	RabbitMQ	5672, 15672	Message queue
	Redis	6379	Cache
	Elasticsearch	9200	Log storage and search
Platform services	appengine	8000	SaaS runtime support
	paas	8001	Developer Center
	esb	8002	Enterprise Service Bus
	login	8003	Single sign-on
	WebSocket	8004	WebSocket access for the Bastion Host
	MCP Server	8020	MCP protocol support
Proxy	8010 (8011, 8012)	Multi-cluster management; 8011 is HTTPS, 8012 is HTTP
Application services	StackStorm	8005	Execution orchestration
	Zabbix	8006	Monitoring
	Grafana	8007	Visualization dashboards
	RDP-websocket	4822	Connect to Windows servers
	Note	To manage internet hosts, the platform needs a dedicated address and these external ports: 80, 443, 4505, 4506, 8011, 8012, 8020, 10051

---