Node Engine — Installation

The Node Engine runs behind a web server on port 3000. Everything below assumes a fresh Linux x86-64 box with systemd and root access.

Register the server in LockFlare Cipher first — add it to an environment and copy the licence key it issues. You need that key in step 4, and it is bound to this machine’s IP address.

Prerequisites — Node.js 24

The interpreter requires Node.js 24. Install it with NVM before anything else.

install node 24

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
nvm install 24
node -v
npm -v

Verify the output shows v24.x.x for node and 11.x.x for npm before continuing.

1 · Install a web server

The Node interpreter listens on port 3000, so a web server sits in front of it on port 80. nginx below; Apache works equally well.

install nginx

sudo apt install nginx -y
sudo nano /etc/nginx/sites-available/default

Delete everything in that file and paste this:

/etc/nginx/sites-available/default

server {
    listen 80;
    server_name _;
    client_max_body_size 20M;

location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_cache_bypass $http_upgrade;

    error_page 502 503 504 = @custom503;
}

location @custom503 {
    default_type application/json;
    return 503 '{"success":false,"message":"LockFlare Interpreter is restarting"}';
}

}

The @custom503 block matters: during a reload the interpreter is briefly unavailable, and without it nginx returns its own HTML error page to API clients expecting JSON.

apply

sudo systemctl restart nginx

2 · Extract the interpreter

/var/www/interpreter

sudo mkdir -p /var/www/interpreter
sudo chown $USER:$USER /var/www/interpreter
cd /var/www/interpreter
wget https://cdn.lockflare.com/interpreter/lockflare-interpreter.tar.gz
tar -xzf lockflare-interpreter.tar.gz
rm lockflare-interpreter.tar.gz

3 · Install dependencies

npm

npm install

4 · Run and configure the licence

Start the engine once by hand. On first run it prompts for the licence key you copied from Cipher.

first run

./lf-engine

expected output

  ╔══════════════════════════════════╗
  ║        LOCKFLARE ENGINE          ║
  ╚══════════════════════════════════╝

  First-time setup
  ─────────────────────────────────
  License key: LF-xxxxx-xxxxx-xxxxx-xxxxx
  Validating license...
  ✓ License validated
  Configuration saved to /var/www/interpreter/.env
[ENGINE] License verified
[ENGINE] Runtime initialized
[ENGINE] Syncing...
[ENGINE] Payload ready
[ENGINE] Service started (PID 12345)
========================================
BOOTSTRAP COMPLETE
[MASTER] Allocated: 4 core(s) — Forking 4 worker(s)...
[MASTER] Workers ready (4)
[WORKER 12350] Listening on http://0.0.0.0:3000

The core allocation you set when registering the server is what the master forks against — four cores, four workers. The key is written to .env in the install directory, so subsequent starts do not prompt. Stop it with Ctrl+C once you see the engine sync — the next step makes it permanent.

5 · Keep it running

The engine must run as a managed service. Two options — PM2 is the recommended one for Node.

This step is not optional if you ever intend to seal this server. Enclave disables every login on the machine, and without a service manager to restart the engine there is no way back in. Cipher asks you to confirm a managed service is present before it will seal.

PM2 — recommended

pm2

sudo npm install -g pm2

cd /var/www/interpreter sudo env "PATH=$PATH" pm2 start ./lf-engine --name lockflare sudo env "PATH=$PATH" pm2 startup sudo env "PATH=$PATH" pm2 save

Day-to-day commands:

operations

# View logs sudo env "PATH=$PATH" pm2 logs lockflare

Restart interpreter

sudo env "PATH=$PATH" pm2 restart lockflare

Stop interpreter

pm2 stop lockflare

Monitor all processes

sudo env "PATH=$PATH" pm2 monit

systemd — alternative

run from /var/www/interpreter

sudo tee /etc/systemd/system/lf-engine.service > /dev/null <<EOF
[Unit]
Description=LockFlare Node.js Interpreter Engine
After=network-online.target
Wants=network-online.target

[Service]
User=root
Group=root
WorkingDirectory=$(pwd)
ExecStart=$(pwd)/lf-engine
EnvironmentFile=$(pwd)/.env
Restart=always
RestartSec=5
Type=simple
TimeoutStartSec=30
TimeoutStopSec=15
KillMode=mixed
KillSignal=SIGTERM
StandardOutput=journal
StandardError=journal
SyslogIdentifier=lf-engine
Slice=system.slice
[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable lf-engine
sudo systemctl start lf-engine

Run that block from inside the install directory — $(pwd) is expanded when the unit file is written, so running it from elsewhere bakes in the wrong path.

operations

sudo journalctl -u lf-engine -f

sudo systemctl restart lf-engine sudo systemctl stop lf-engine sudo systemctl status lf-engine

Confirm it worked

Open Monitoring in Cipher. The server should appear online within a few seconds, reporting latency, heap and uptime.

If it stays unreachable, the cause is almost always port 80 — the control plane reaches the server by IP over HTTP, and it needs that port even when your site serves HTTPS. See Server requirements.

Activity log Node Engine — configuration