Server requirements

A LockFlare server is an appliance. It should run the Engine and nothing else — no database, no second application, no files that matter.

Operating system

Linux x86-64 with systemd. The Engine installs as a system service and runs as root. Any mainstream distribution works — Ubuntu, Debian, Rocky, Alma.

Both runtimes need their platform present: Node.js 24 for the Node Engine, the ASP.NET Core 10 runtime for the .NET Engine.

Network

Port	Required	Why
`80`	Always	The control plane reaches the server by IP over HTTP for reloads, health checks and Enclave operations. Certificate renewal depends on it too.
`443`	Conditional	Only if the server terminates TLS itself. Not needed behind a CDN or reverse proxy.

Port 80 stays open even when you serve HTTPS. This catches people out. The control plane addresses your server by IP address, not by domain name, so it cannot use a certificate issued for your domain. Closing port 80 does not break your site — it breaks reloads, health reporting and sealing, and it will look like the server has gone offline.

Debug tools must not be present

The Engine refuses to seal on a machine with strace, gdb or ltrace installed. Those tools attach to a running process and read its memory, which is precisely the attack that RAM-only execution exists to make expensive.

check before installing

which strace gdb ltrace # no output means you are clear

if any are present:

apt remove --purge strace gdb ltrace # Debian / Ubuntu dnf remove strace gdb ltrace # Rocky / Alma

Sizing

Cores are what you licence, so allocate them per server according to the traffic that server takes. A single core is enough for a low-traffic site; a busy API benefits from more. You can change the allocation later without reinstalling.

Memory is the resource to watch, because your application is decrypted into it. Budget for your normal working set plus the decrypted build — in practice this is close to what the same application would use running natively, since it is the same code doing the same work.

Dedicated, and disposable

The appliance constraint is not arbitrary. It is what makes a server replaceable: if the box is lost, corrupted or sealed shut, you install the Engine on a fresh one and push every project back encrypted. Minutes, not a recovery project.

That only holds while the server stays dedicated. Put a database on it and you have created something you have to back up, restore and care about — and the whole recovery story goes with it.

Licensing Installation