Admin guide — self-host 21tunnel

→ The eight tasks

Roughly the order you'll do them in. Each is self-contained and cites exact commands, file paths, and config keys — no placeholders.

1 · Install

Clone, build qnt-server, create Postgres, run as a hardened systemd unit. Migrations auto-run on boot.

2 · Configure auth

JWT signing key, the admin token, Google + GitHub OAuth, secure-cookie + dashboard-URL knobs.

3 · Enable HTTP/3

Flip the [http3] block, wildcard cert, the UDP/443 firewall plumbing, and the Alt-Svc header.

4 · Configure billing

Dodo Payments (merchant-of-record): the four QNT_DODO_* env vars, products, webhook secret.

5 · Backups & restore

The nightly qnt-backup.timer, what it captures, optional R2 off-host mirror, and the restore drill.

6 · Upgrade & roll back

Pull, rebuild, restart, smoke. And the one-minute rollback when a release goes bad.

7 · Alerts

Slack + Discord webhook fan-out via a systemd drop-in. Get paged when the server bounces.

8 · Monitoring

Prometheus metrics on 127.0.0.1:9090, the journal, optional OpenTelemetry export.

★ The exhaustive reference lives in the repo

These pages are the task-shaped front door. The complete operator manual — architecture, every config key, 8 runbooks, 10 ADRs, the security model, DR objectives — is docs/PRODUCTION.md in the repo. When in doubt, it is canonical.

Run it yourself.