Setup guide

Build the Server

A retired office PC with an SSD makes a solid signage server. Plan on about two hours from bare machine to first login: install Ubuntu Server, fix its address, lock it down, then run our installer.

1. Choose the machine

Planning figures; final minimums are set at the 1.0 release.

Replace any spinning hard drive with an SSD; it’s the single biggest reliability upgrade for a 10-year-old PC. Wired Ethernet only. A small UPS (around 600 VA) rides out flickers and prevents corrupted disks.

2. Set the BIOS

• Restore on AC power loss: Power On, so the server comes back by itself after an outage
• Boot order: USB first for the install, then the SSD
• Disable Wake-on-LAN unless you use it; enable virtualization (harmless, sometimes needed)
• Secure Boot can stay on; Ubuntu supports it

3. Install Ubuntu Server

1. Download Ubuntu Server 26.04 LTS (supported to April 2031) from ubuntu.com/download/server. 24.04 LTS also works.
2. Write it to the USB stick with balenaEtcher (Mac/Windows/Linux) or Rufus (Windows).
3. Boot from the stick and choose:
   • Language and keyboard
   • Network: leave on DHCP for now (step 4 fixes it)
   • Storage: Use an entire disk, with LVM
   • Profile: server name signage, a username, a strong password
   • Install OpenSSH server: yes
   • Featured snaps: none
4. Remove the stick and reboot. Log in at the console or over SSH.

4. Give it a fixed address

Easiest: a DHCP reservation on the router (MAC → IP). The MAC is in ip link. If the router can’t reserve, set it on the server in /etc/netplan/50-signage.yaml:

network:
  version: 2
  ethernets:
    eno1:                # your interface name from `ip link`
      dhcp4: false
      addresses: [10.10.50.10/24]
      routes:
        - to: default
          via: 10.10.50.1
      nameservers:
        addresses: [10.10.50.1, 1.1.1.1]

Apply with sudo netplan apply, then confirm ping -c 3 1.1.1.1 works.

5. Update and keep it updated

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades   # answer Yes
sudo timedatectl set-timezone America/Los_Angeles  # your zone

Security updates now install nightly. Correct time matters: schedules and certificates both depend on it.

6. Secure SSH

1. From your laptop: ssh-copy-id youruser@10.10.50.10, then confirm you can log in without a password.
2. On the server, edit /etc/ssh/sshd_config and set PasswordAuthentication no and PermitRootLogin no.
3. sudo systemctl restart ssh. Keep your current session open until a new one connects.

7. Turn on the firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from 10.10.0.0/16 to any port 22 proto tcp   # SSH from inside only
sudo ufw allow 443/tcp                                      # players + admin
sudo ufw allow 80/tcp                                       # certificate renewal
sudo ufw enable
sudo ufw status verbose

Single-network setups with no public exposure can replace the 443/80 lines with your LAN range only.

8. Point the name at it

Setups 2 and 3 only: create the DNS record, port forward or tunnel, and split DNS per 4 · Domain & Remote Access and 2 · Large Property (Glen Eden). Confirm nslookup signage.yourdomain.com returns the right IP from inside and outside before continuing; the certificate step fails otherwise.

9. Install Reboot Signage (installer TBD)

curl -fsSL https://rebootsignage.com/install.sh -o install.sh
less install.sh          # read it before you run it
sudo bash install.sh

The installer asks for:

• Hostname: signage.yourdomain.com, or the LAN IP for setup 1
• An email for certificate expiry notices
• The first admin username and password
• License key, or leave blank for the 30-day evaluation

It installs the web server and database, requests the Let’s Encrypt certificate, and starts the service. When it finishes, open https://signage.yourdomain.com/admin from the office.

10. Back it up

The server holds the only copy of your schedules and settings. Back up nightly to something that isn’t the server: a USB drive, a NAS, or cloud storage.

# /etc/cron.d/signage-backup  (paths: installer TBD)
30 2 * * * root reboot-signage backup --to /mnt/backup/signage-$(date +\%F).tar.gz

Keep 14 days. Test a restore on a spare PC once, before you need it.

11. Check it

• https://signage.yourdomain.com shows a padlock from inside and outside the property
• An SSL Labs test (ssllabs.com/ssltest) scores A
• The server survives a pull-the-plug test: unplug, plug in, and it’s back on its own within 3 minutes
• Then work through 7 · Security Checklist