Go to onprem.fipsign.dev/trial, enter your corporate email, and click Request trial. A verification link will be sent to your email. After clicking it, you will receive the license.pqp file at the same address. The download link is single-use and expires in 24 hours.

Go to onprem.fipsign.dev/purchase and complete the payment via OxaPay (crypto). The license.pqp file will be sent to your email after payment is confirmed. The download link is single-use and expires in 48 hours.

# From your local machine
scp license.pqp root@YOUR_SERVER_IP:/root/

# On your server, as root
curl -fsSL https://proxyonprem.fipsign.dev/install -o install.sh && bash install.sh

At the end of the installation, the terminal prints your admin token:

http://YOUR_SERVER_IP:9090/dashboard

Log in by pasting the admin token. If SMTP is configured, you can also log in with an OTP sent to the operator email.

# Requires an active dashboard session
POST /api/v1/admin/rotate-token

The old token is immediately invalidated. The new token is returned in the response — copy it before closing the session.

If you have lost the token and have no active session, run this command on your server via SSH. It requires no dashboard access, no SMTP, and no DB knowledge — just SSH to your server as root:

# On your server, as root
docker compose exec api pq-proxy-api reset-token

A new token is generated, saved to the database, and printed to the terminal. The old token is immediately invalidated.

POST /api/v1/admin/invalidate-sessions

Forces all active sessions to log out. Useful if you suspect a session was compromised.

Point the domain's A record to your server's public IP:

Type:  A
Name:  api
Value: YOUR_SERVER_IP
TTL:   3600

Enable ACME during installation or via reconfiguration. The proxy issues HTTP-01 challenges on port 80. Once a domain is added, the certificate is provisioned on the first connection. Renewal is checked every 12 hours — certificates are automatically renewed when they have fewer than 10 days remaining. The expiry date is read directly from the certificate X.509 field, so any certificate duration is supported.

Go to Dashboard → Domains, click Upload BYOC on your domain, and paste your PEM-encoded certificate and private key.

# List all certificates with expiry dates
GET /api/v1/certificates

curl -sv https://api.yourcompany.com 2>&1 | grep -i "ssl\|tls\|x25519"

Open your domain in Chrome or Brave, press F12, go to Security tab. The connection line should show TLS 1.3, X25519MLKEM768, and AES_128_GCM.

The proxy automatically falls back to X25519 (classical Diffie-Hellman). The connection is still TLS 1.3 — just without the post-quantum key exchange. No configuration needed.

Every time the proxy-core container starts, it reads license.pqp from disk and verifies the ML-DSA-65 signature against the public key embedded in the binary. If the signature is invalid or the file is missing, the proxy does not start.

The proxy-core sends a heartbeat to proxyonprem.fipsign.dev/v1/heartbeat every 24 hours. The heartbeat includes the license_key and the current proxy version. FIPSign validates the license and responds with {"ok": true} if it is valid, or {"ok": false, "status": "revoked"} if it has been revoked.

Go to Dashboard → License and click Re-verify. This re-reads the license.pqp file from disk and updates the verified_at timestamp in the database.

SMTP is configured during installation. To add or change it later, run bash install.sh --reconfigure and answer Y to the SMTP question.

Set a Webhook URL during installation. The payload is a JSON POST signed with HMAC-SHA256 using the webhook_secret from config.toml. Verify the signature in your handler with the X-Webhook-Signature header.

# Example webhook payload
{
  "event":   "cert_expiry_warning",
  "domain":  "api.yourcompany.com",
  "expires": "2026-07-25T10:00:00Z",
  "days":    5
}

Answer Y to Enable Prometheus endpoint? during the installer wizard. This sets prometheus_enabled = true in config.toml.

http://YOUR_SERVER_IP:9090/metrics

# prometheus.yml
scrape_configs:
  - job_name: pqproxy-onprem
    static_configs:
      - targets: ['YOUR_SERVER_IP:9090']

Go to Dashboard → Audit Log to browse recent events with timestamps, actor IP, and action details.

GET /api/v1/audit-log

GET /api/v1/audit-log/export

Downloads the full audit log as a CSV file. Useful for compliance and external auditing.

GET /api/v1/metrics/connections

GET /api/v1/metrics/latency

GET /api/v1/connections/export

Downloads all connection logs within the retention window (configured at install time, default 30 days) as a CSV file. Each row is one TLS connection with fields: id, domain, peer_addr, bytes_sent, bytes_received, algorithm, connected_at, duration_ms, tls_handshake_ms, backend_connect_ms.

If automatic update checks are enabled (default: every 24 hours), the dashboard shows a notification when a new version is available. You can also check manually:

GET /api/v1/updates/check

# On your server, as root
docker compose pull && docker compose up -d

This pulls the latest api and proxy images from GHCR and restarts the containers. The database is not affected — all configuration and data is preserved. Downtime is typically under 5 seconds.

curl -fsSL https://proxyonprem.fipsign.dev/install -o install.sh && bash install.sh --reconfigure

The wizard shows the current value of every setting as the default — press Enter to keep it, or type a new value. The database configuration is preserved automatically (cannot be changed via the wizard — edit config.toml manually if needed).

# Edit the configuration file
nano /root/config.toml

# Apply changes by restarting the API container
docker compose restart api

Changes to proxy settings (ports, real_ip_source, allow_private_backends) also require restarting the proxy container: docker compose restart api proxy.

After logging in, the API sets a session cookie. All authenticated requests use this cookie automatically in the browser. For programmatic access, use the token login endpoint to obtain a session cookie, then include it in subsequent requests.

# Login with static token
curl -c cookies.txt -s \
  -X POST http://YOUR_SERVER_IP:9090/api/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"token": "pqp_onprem_..."}'

# Use the session cookie in subsequent requests
curl -b cookies.txt -s \
  http://YOUR_SERVER_IP:9090/api/v1/license

Yes. The license.pqp file contains a JSON payload signed with ML-DSA-65 (NIST FIPS 204). The proxy binary has the FIPSign public key embedded at compile time. Verification requires no network access — the signature is checked against the embedded key on every startup.

If SMTP is configured, log in with an OTP and rotate the token from the dashboard. If SMTP is not configured and you have no active session, run this command on your server via SSH:

docker compose exec api pq-proxy-api reset-token

This generates a new token, saves it to the database, and prints it to the terminal. No manual database access required. The old token is immediately invalidated.

The proxy continues operating normally for 30 days after the license expires. All existing connections are served. You can add new domains. After the grace period ends, internal_list_domains returns an empty list — the proxy stops routing traffic until a valid license is installed.

Purchase a new standard license at onprem.fipsign.dev/purchase. Download the new license.pqp file, copy it to the server at /root/license.pqp, and click Re-verify in the dashboard. No restart required — the new license is loaded immediately.

The license file does not enforce a specific server. However, each license is intended for use within a single organization. Running the same license on servers belonging to different organizations violates the terms of service and may result in revocation.

# Stop and remove all containers and volumes
docker compose down -v

# Remove configuration files
rm -f /root/compose.yml /root/config.toml /root/.env /root/install.sh