SEC.01

The playbook

The run starts read-only: the recon probes decide what happens next. The steps that follow are adapted to the distribution and state found — a real machine is rarely clean.

1. 01reconDocker Engine + compose plugin present?
2. 02reconGarage already installed (container, binary, service) or existing /opt/garage/garage.toml? → do not recreate or regenerate the secrets, verify
3. 03reconports 3900-3903 free? (empty, unless an existing Garage)
4. 04reconfree space > requested capacity (otherwise lower it) and RAM ≥ 512 MB
5. 05recondistro for the official Docker repository
6. 06recononly if a domain is provided: is a reverse proxy already on 80/443? (reuse it)
7. 07actOfficial Docker repository (only if Docker is missing)verify
8. 08actDeclare the Docker apt source (Debian/Ubuntu, if Docker is missing)verify
9. 09actInstall Docker Engine (if missing)verify
10. 10actWrite /opt/garage/garage.toml (generated secrets)verify
11. 11actWrite /opt/garage/compose.yamlverify
12. 12actStart Garageverify
13. 13actAssign the single-node layoutverify
14. 14actApply the layoutverify
15. 15actCreate the first bucketverify
16. 16actCreate the access keyverify
17. 17actGrant the key access to the bucketverify
18. 18actS3 API health checkverify
19. 19actInstall Caddy (only if a domain is provided and no reverse proxy)verify
20. 20actHTTPS reverse proxy for the S3 API (only if a domain is provided)verify

SEC.02

What it verifies

Each step ships its own check. The run only moves on when the check passes, so what the recipe reports as done is what is actually on the server.

1. 01verifyOfficial Docker repository (only if Docker is missing)Verified bytest -s /etc/apt/keyrings/docker.asc -o -f /etc/yum.repos.d/docker-ce.repo && echo ok
2. 02verifyDeclare the Docker apt source (Debian/Ubuntu, if Docker is missing)Verified bycat /etc/apt/sources.list.d/docker.list
3. 03verifyInstall Docker Engine (if missing)Verified bysystemctl is-active docker && docker compose version
4. 04verifyWrite /opt/garage/garage.toml (generated secrets)Verified bystat -c '%a %U' /opt/garage/garage.toml && grep -cE '^(rpc_secret|admin_token|metrics_token) = "[^"]+"' /opt/garage/garage.toml
5. 05verifyWrite /opt/garage/compose.yamlVerified bydocker compose -f /opt/garage/compose.yaml config -q && echo ok
6. 06verifyStart GarageVerified bydocker ps --filter name=^garage$ --format "{{.Status}}" && docker exec garage /garage status
7. 07verifyAssign the single-node layoutVerified bydocker exec garage /garage layout show
8. 08verifyApply the layoutVerified bycurl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3903/health
9. 09verifyCreate the first bucketVerified bydocker exec garage /garage bucket list
10. 10verifyCreate the access keyVerified bystat -c '%a' /root/servor-garage-${key_name}.key && grep -ci 'secret' /root/servor-garage-${key_name}.key
11. 11verifyGrant the key access to the bucketVerified bydocker exec garage /garage bucket info ${bucket}
12. 12verifyS3 API health checkVerified bycurl -s -o /dev/null -w '%{http_code}' http://127.0.0.1:3900/
13. 13verifyInstall Caddy (only if a domain is provided and no reverse proxy)Verified bycaddy version && systemctl is-active caddy
14. 14verifyHTTPS reverse proxy for the S3 API (only if a domain is provided)Verified bycurl -s -o /dev/null -w '%{http_code}' --retry 6 --retry-delay 5 https://${domain}/

SEC.03

Guardrails

Non-negotiable instructions the run must respect, whatever it finds on the server.

SEC.04

Variables

What you choose before launching — the recipe fills in the rest.

SEC.05

How a recipe runs in Servor

Servor is zero-knowledge: the platform cannot execute anything on its own. When you launch this recipe, a run reads the reconnaissance, plans the steps and asks for your approval. Each approved command is signed by your browser — with a key the server never sees — then relayed verbatim to the agent, which verifies the signature locally before executing.

SEC.06

Deploy on Servor button

Maintain Garage (S3 storage) or a project that needs it? Put this button in your README or on your site: one click and your users install it on their own server.

SEC.07

More storage & backup recipes

1. 01Swap fileCreates a persistent swap file of the chosen size. Destructive: modifies /etc/fstab.
2. 02restic backupsrestic + a scheduled, encrypted backup of a folder to a repository.
3. 03MinIOS3-compatible MinIO object storage via Docker, local-only. Community project archived: frozen image.
4. 04Samba shareSamba file server (SMB). Destructive: creates a share and a user.
5. 05Borg backupsBorgBackup + a scheduled encrypted backup of a folder.