Deployment guide

Private cloud deployment guide

Plan, install, validate, operate, and activate a single-node or clustered Lanying private cloud, including internal-network and offline environments.

Private cloud runs the Lanying service stack inside infrastructure you control. The installer supports single-node and clustered topologies, online or internal-network registration, offline installation, and selected managed infrastructure services.

Choose a topology

Topology	Use it when	Operational trade-off
Single node	Development, evaluation, or a small workload where host downtime is acceptable.	Simplest install, but the host is a single point of failure.
Cluster	Production workloads requiring capacity and node-failure tolerance.	Requires at least three prepared hosts, stable internal networking, SSH orchestration, and coordinated operations.
Managed dependencies	Your organisation already operates compatible Redis, MySQL/RDS, Kafka, or object storage.	Reduces local components but adds network, credential, compatibility, and availability dependencies.
Offline	Installation hosts cannot reach the public network.	Requires the offline image/config flow and recurring licence activation.

Provision the application and installer

Create the application in the Lanying console and select the private cloud plan.
Open the private cloud page and generate a short-lived installation token or the required offline configuration.
Download maxim.ctl for the target architecture and verify its source, permissions, and version through your internal software process.
Record the App ID, future client DNS endpoint, server API endpoint, administrator token rotation plan, and responsible operators.

Download the installerbash

$ wget https://package.lanyingim.com/linux/amd64/maxim.ctl

Prepare hosts and network

Item	Legacy baseline	Production decision
Operating system	Ubuntu 24.04 recommended in the source guide	Confirm the current installer support matrix before provisioning.
Host size	4 CPU cores, 8 GB RAM, 100 GB disk	Size from concurrency, retention, file traffic, observability, and failure headroom.
Cluster size	Three or more servers	Use distinct failure domains where supported.
HTTP(S)	TCP 80 and 443	Restrict sources and terminate TLS according to the deployment architecture.
Voice & video	TCP/UDP 3478 and UDP 10000-60000	Validate NAT, firewall, public addressing, and the current media-port specification.

Use stable hostnames, clocks, DNS, routes, and storage before installation.
For clusters, configure the first host to reach every node over SSH and make node names unique.
Back up firewall, load-balancer, certificate, and DNS changes in infrastructure-as-code or an audited change system.
Do not expose database, cache, Kafka, object-storage, or orchestration ports to untrusted networks.

Install a single node

Download and make executablebash

wget https://package.lanyingim.com/linux/amd64/maxim.ctl && sudo chmod u+x maxim.ctl

Online installationbash

sudo ./maxim.ctl install --token INSTALL_TOKEN

Internal-network registrationbash

sudo ./maxim.ctl install --net internal --token INSTALL_TOKEN

Installation tokens are secrets. Supply them through an approved operator workflow, avoid shell-history and log exposure, and revoke or rotate them after use when the console supports it.

Install a cluster

Prepare at least three hosts and confirm bidirectional service networking.
Set unique stable hostnames and configure the first node's SSH access to the remaining nodes.
Run maxim.ctl from the first node with the complete explicit node list.
Use --net internal when public-network registration is unavailable.
Wait for installation, health checks, and migrations to finish before directing clients to the cluster.

Three-node installationbash

sudo ./maxim.ctl install --nodelist 172.16.0.78 172.16.0.79 172.16.0.80 --token INSTALL_TOKEN

Use managed infrastructure

Dependency	Configuration area	Validate before install
Redis storage/cache	redis-server/password and redis-cache-server/password	Version, TLS/authentication, latency, capacity, persistence, and failover.
MySQL or RDS	mysql-server/username/password	Supported engine version, charset, TLS, privileges, backups, and connection limits.
Kafka	kafka-server/user/password	Supported protocol/version, authentication, partitions, retention, and network reachability.
Object storage	storage type, endpoint, access keys, and separate bucket names	Least privilege, region/endpoint, lifecycle, encryption, CORS where applicable, and data residency.

Apply managed-service configuration before the install command. Store credentials outside command history where possible, rotate them after any exposure, and document whether the installer persists them in cluster secrets.

Offline installation and activation

Download the offline ISO through a connected and trusted staging environment, verify it, and transfer it to the installation network.
Mount the image and place maxim.ctl in an approved executable path.
Generate the offline configuration from the console and transfer it securely.
Install with --config-file, adding --nodelist for a cluster.
Export the licence key, activate the cluster in the console, and execute the returned activation command inside the private environment.
Repeat the documented activation process before licence expiry and after relevant console configuration or administrator-token changes.

Mount the offline imagebash

mkdir -p /lanying && mount -o loop lanying-im-server*.iso /lanying && cp /lanying/maxim.ctl /usr/bin/

Offline single-node installbash

sudo maxim.ctl install --config-file maxim.*.conf

Validate before client cutover

Wait for every console system-status check and required migration to report healthy.
Create test users and verify password/token sign-in, one-to-one chat, groups, history, files, push, and voice & video where enabled.
Verify api_endpoint and client DNS configuration from inside and outside every intended network zone.
Test TLS chains, certificate renewal, load balancing, node failure, backup restore, storage exhaustion, and dependency failover.
Measure latency and capacity with representative connections, message rates, file traffic, history retention, and media sessions.
Plan rollback and hosted/private data migration before changing production endpoints.

Operate the deployment

Practice	Minimum coverage
Monitoring	Node/service health, connections, send errors, queues, database/cache/storage, media, certificates, and licence status.
Backup	Databases, object storage, configuration, credentials, and tested restoration procedures.
Security	Patch cadence, least privilege, secret rotation, audit logs, segmentation, vulnerability response, and incident ownership.
Change management	Installer/platform compatibility, staged upgrades, rollback, migration tracking, and maintenance communication.
Capacity	Connection, message, group, history, file, push, and media forecasts with failure headroom.

Create an app →Server API guide →Platform support →