​

1. Prepare the server

In short. You install Docker and some tools, and open only the ports that the app needs. You point your domain to the server and create your deploy and signing keys. Then you install the small scripts that run each deploy. At the end, the server accepts only releases that you signed, and only through your deploy key. You do this page once.

​

Step 1. Check that Polymarket allows the server’s location

1. On the server, ask Polymarket if it permits this location:
   curl -s https://polymarket.com/api/geoblock
   
   If the server says curl: command not found, type sudo apt install curl and try again.
2. Read the answer. It must contain "blocked":false.
3. If the answer contains "blocked":true, stop. This server cannot trade. Rent a server in a different region.
4. On the server, make sure that no proxy is set. Type each command. Each command must show nothing:
   env | grep -i _proxy
   
   grep -i proxy /etc/environment
   
   sudo systemctl show docker --property=Environment | grep -i proxy
   
   sudo grep -s proxies /root/.docker/config.json
   

​

Step 2. Install the software

1. On the server, install Docker. Follow Docker’s own instructions: https://docs.docker.com/engine/install/. You need Docker Engine 27 or later, with the compose and buildx plugins. Docker’s instructions install the two plugins.
2. On the server, install git, age, rsync and the firewall:
   sudo apt install git age rsync ufw
   
3. On the server, turn on the automatic clock sync:
   sudo timedatectl set-ntp true
   

​

Step 3. Open only the ports the app needs

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow from <your-ip> to any port 22 proto tcp
sudo ufw allow from <backup-ip> to any port 22 proto tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw allow 443/udp
sudo ufw enable

​

Step 4. Point your domain at the server

• The server has an IPv6 address.
• You will do the IPv6 check (S6) in the security checklist.

​

Step 5. Create the two service accounts

sudo adduser --disabled-password --gecos "" --shell /bin/sh deploy

sudo adduser --system --group --home /var/lib/sesame-backup --shell /bin/sh sesame-backup

​

Step 6. Move SSH keys to root-owned files

sudo install -d -o root -g root -m 0755 /etc/ssh/authorized_keys
for u in <admin> deploy sesame-backup; do
  sudo install -o root -g root -m 0644 /dev/null "/etc/ssh/authorized_keys/$u"
done
sudo sh -c 'cat /home/<admin>/.ssh/authorized_keys > /etc/ssh/authorized_keys/<admin>'
sudo rm -rf /home/deploy/.ssh

​

Step 7. Create the deploy key

1. Put the security key into your computer.
2. On your computer, create the deploy key:
   ssh-keygen -t ed25519-sk -O verify-required -C sesame-deploy -f ~/.ssh/sesame_deploy
   
   If you do not have a security key, use the command below. Set a passphrase when it asks.
   ssh-keygen -t ed25519 -C sesame-deploy -f ~/.ssh/sesame_deploy
   
3. On your computer, show the public key. Copy the line that it shows:
   cat ~/.ssh/sesame_deploy.pub
   
4. On the server, open the key file of the deploy account:
   sudoedit /etc/ssh/authorized_keys/deploy
   
5. Write one line: the start below, then a space, then the public key that you copied.
   restrict,verify-required,from="<your-ip>",command="/usr/local/sbin/sesame-deploy-shell" sk-ssh-ed25519@openssh.com AAAA... sesame-deploy
   
   For a key with a passphrase, remove verify-required, from the start. That public key starts with ssh-ed25519.
6. Save the file and close the editor.

​

Step 8. Set up release signing and sign the first release

1. Create a signing key. Set a passphrase when it asks:
   ssh-keygen -t ed25519 -C sesame-release -f ~/.ssh/sesame_release
   
2. Tell git to sign with this key:
   git config --global gpg.format ssh
   git config --global user.signingkey ~/.ssh/sesame_release.pub
   
3. Create your list of allowed signers. Keep it outside the repository:
   mkdir -p ~/.config/sesame
   echo "<your-email> namespaces=\"git\" $(cat ~/.ssh/sesame_release.pub)" > ~/.config/sesame/allowed_signers
   
4. Show the list and copy the line. The server needs it in Step 9:
   cat ~/.config/sesame/allowed_signers
   
5. Go to your copy of the repository. Sign a tag on the reviewed commit that you want to run. Each release tag name must start with release-:
   git tag -s <tag> <commit> -m "<tag>"
   
6. Send the tag to the repository:
   git push origin <tag>
   

​

Step 9. Create the server’s deploy settings

1. On the server, create the settings folders and files:
   sudo install -d -o root -g root -m 0755 /opt/sesame /etc/sesame
   sudo install -o root -g root -m 0644 /dev/null /etc/sesame/deploy.conf
   sudo install -o root -g root -m 0644 /dev/null /etc/sesame/allowed_signers
   
2. Open the list of allowed signers:
   sudoedit /etc/sesame/allowed_signers
   
3. Paste the line from Step 8, item 4. Save the file and close the editor.
4. Open the deploy settings:
   sudoedit /etc/sesame/deploy.conf
   
5. Write these four lines with your values. Save the file and close the editor.
   DOMAIN=<your-domain>
   ACME_EMAIL=<your-email>
   REPO_URL=<repo-url>
   VERIFY_TAGS=yes
   

​

Step 10. Install the server scripts

1. On the server, become root:
   sudo -i
   
2. Get the tag and check its signature:
   git init -q --bare /opt/sesame/repo.git
   git -C /opt/sesame/repo.git fetch --no-tags <repo-url> refs/tags/<tag>:refs/tags/<tag>
   oid=$(git -C /opt/sesame/repo.git rev-parse --verify refs/tags/<tag>)
   git -C /opt/sesame/repo.git -c gpg.ssh.allowedSignersFile=/etc/sesame/allowed_signers verify-tag "$oid"
   
   The last line must show Good "git" signature. If it does not, stop. Do Step 8 and Step 9 again.
3. Install the scripts and the timer:
   mkdir /tmp/sesame-setup && git -C /opt/sesame/repo.git archive "$oid" deploy | tar -x -C /tmp/sesame-setup
   install -o root -g root -m 0755 /tmp/sesame-setup/deploy/sesamectl /usr/local/sbin/sesamectl
   install -o root -g root -m 0755 /tmp/sesame-setup/deploy/sesame-deploy-shell /usr/local/sbin/sesame-deploy-shell
   install -m 0644 /tmp/sesame-setup/deploy/systemd/sesame-seal-backups.* /etc/systemd/system/
   systemctl daemon-reload
   
4. Open the access rule for the deploy account:
   visudo -f /etc/sudoers.d/sesame
   
5. Paste these two lines. They are the content of deploy/sudoers.example. Save the file and close the editor.
   Defaults:deploy env_reset, !setenv, secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
   deploy ALL=(root) NOPASSWD: /usr/local/sbin/sesamectl
   
6. Remove the temporary files and leave the root shell:
   rm -rf /tmp/sesame-setup
   exit
   

​

Step 11. Lock down SSH

1. On the server, copy the SSH settings from the tag:
   sudo install -o root -g root -m 0644 /dev/null /etc/ssh/sshd_config.d/50-sesame.conf
   sudo sh -c 'git -C /opt/sesame/repo.git show refs/tags/<tag>:deploy/sshd-sesame.conf.example > /etc/ssh/sshd_config.d/50-sesame.conf'
   
2. Open the file:
   sudoedit /etc/ssh/sshd_config.d/50-sesame.conf
   
3. On the AllowUsers line, replace admin with <admin>. Save the file and close the editor.
4. Check the settings and load them:
   sudo sshd -t && sudo systemctl reload ssh
   
5. Keep your current session open. Open a new terminal on your computer and log in to the server again. Close the first session only after the new login works.

​

Step 12. Record the server’s fingerprint

1. In the provider’s web console, not over SSH, show the server’s fingerprint:
   ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub
   
2. Write down the part that starts with SHA256:.
3. On your computer, connect to the server by its domain name:
   ssh <admin>@<your-domain>
   
4. ssh shows an ED25519 key fingerprint and asks if you want to continue. Compare it with the fingerprint from item 2.
5. If the two fingerprints are the same, type yes. If they are different, type no and stop. Do not deploy to this server.
6. Type exit to close the connection.

​

Is it working?

ssh -i ~/.ssh/sesame_deploy -o IdentityAgent=none deploy@<your-domain> id