OpenProof / Install

From a clean server to a running identity service.

The packaged installer handles the release package, PostgreSQL, cryptographic material, the first owner, email delivery, providers, Nginx, TLS and final health checks.

Quick install

shellrecommended

curl -fsSL https://genyleap.com/install/openproof | sudo sh

The bootstrap endpoint detects the supported operating system and CPU architecture and prefers a matching GitHub Release package with SHA-256 verification. While a prebuilt release is unavailable, Ubuntu automatically falls back to installing the qualified build dependencies, compiling OpenProof and packaging it locally before launching the same setup wizard.

Ubuntu 24.04+Debian 13+AMD64ARM64systemd

What the wizard configures

Identity origin

Choose the public domain, organization identity and initial owner account.

PostgreSQL and secrets

Install a local database or connect an existing one. OpenProof generates signing, encryption, pepper and audit secrets with restricted filesystem permissions.

Email delivery

Use an authenticated SMTP relay, direct Postfix, an existing HTTPS delivery webhook, or configure delivery later.

Authentication providers

Select only the providers you need. The wizard then asks for the matching Client ID, Client Secret, API key or RPC configuration.

TLS and ingress

Provision Nginx with Let's Encrypt, use an existing certificate, or place OpenProof behind an external HTTPS ingress.

Verify

Configuration, systemd, local readiness and the public identity origin are checked before setup completes.

Provider credentials

Every redirect provider uses the callback derived from your identity domain:

callbackregister this upstream

https://identity.example.com/auth/federated/callback

Provider	Setup asks for
Google	Client ID + Client Secret
GitHub	Client ID + Client Secret
Microsoft	Tenant ID + Client ID + Client Secret
Apple	Services ID + client-secret JWT
LinkedIn	Client ID + Client Secret
Telegram	Client ID + Client Secret
X	API Key + API Secret
Ethereum	Optional smart-wallet RPC mappings
Farcaster	Optimism RPC endpoint

Credentials are stored outside the public configuration and repository. Providers that are not selected are simply left unconfigured.

Email delivery

OpenProof creates and validates verification challenges but keeps message delivery behind a separate authenticated boundary.

flowdelivery boundary

OpenProof
    ↓
authenticated delivery adapter
    ↓
SMTP / Postfix / your HTTPS webhook
    ↓
user inbox

Direct mail needs DNS work outside the installer.

If you choose direct Postfix delivery, configure PTR/rDNS, SPF, DKIM and DMARC for the sending domain. The installer can configure the local service, but those public DNS and provider controls remain operator-owned.

Install options

shellpackage only

curl -fsSL https://genyleap.com/install/openproof | \
  sudo sh -s -- --no-setup

sudo openproof setup

shellspecific version

curl -fsSL https://genyleap.com/install/openproof | \
  sudo sh -s -- --version 1.1.0

shellrelease candidate

curl -fsSL https://genyleap.com/install/openproof | \
  sudo sh -s -- --channel rc

After installation

shellmanagement

sudo openproof status
sudo openproof doctor
sudo openproof config
sudo openproof config providers
sudo openproof update
sudo openproof backup /var/backups/openproof.dump

Use doctor after changes.

openproof doctor checks the binary, configuration, service state, PostgreSQL, Nginx, local/public readiness and OIDC discovery.