LockFlare

A server will not come online

A registered server that never appears online, or drops out later. In practice this is one of four things, and the first is by far the most common.

1 · Port 80 is closed

Port 80 must be reachable on the server’s IP, even when your site serves HTTPS. The control plane addresses the server by IP address, so it cannot present a certificate issued for your domain. Closing 80 does not break your site — it breaks reloads, health reporting and sealing, and the server simply looks offline.
from your own machine
curl -sS -m 5 -i http://YOUR.SERVER.IP/ping

A response means the path is open. A timeout means a firewall, a security group, or a cloud network ACL is in the way — check the provider’s firewall as well as the host’s, since both have to allow it.

2 · The IP does not match the licence

A licence is bound to the address you entered when registering the server. If that address was mistyped, or the machine sits behind NAT and its public address differs from what you registered, the engine will start but never be recognised.

Compare the address on the server against the one in Cipher:

on the server
curl -sS https://api.ipify.org; echo

If they differ, remove the server in Cipher and register it again with the correct address. The licence cannot be repointed.

3 · The engine is not running

systemd
sudo systemctl status lf-engine
sudo journalctl -u lf-engine -n 100 --no-pager
pm2
sudo env "PATH=$PATH" pm2 logs lockflare --lines 100

A licence problem appears in these logs explicitly. So does a missing runtime — Node 24 or the ASP.NET Core 10 runtime.

4 · Node only: the web server in front is down

The Node engine listens on port 3000 behind nginx. If nginx is not running, port 80 answers nothing even though the engine is healthy.

node hosts only
sudo systemctl status nginx
sudo nginx -t
curl -sS -i http://127.0.0.1:3000/ping

If the last command answers but the public IP does not, the problem is nginx or the firewall, not LockFlare. The .NET engine binds port 80 directly and has no reverse proxy, so this step does not apply.

If the server is sealed, steps 3 and 4 are not available to you — there is no login. A sealed server that has gone quiet and does not come back on its own has to be rebuilt. See Understanding a LockFlare server.