Installation
EasyDC is packaged for the Debian and Red Hat families on x86_64 and arm64. Install it from the EasySYS package repository so upgrades arrive through your package manager. Nothing is installed on your domain controllers — EasyDC reaches them over LDAP/LDAPS.
The binary is statically linked, so it depends on no system library and runs on any Linux distribution of either family — RHEL 8 and Debian 10 included — and the bare binary runs on others such as Alpine.
Install from the package repository
# Add the EasyDC repository (signed)
curl -fsSL https://repo.easysys.io/easydc/stable/debian/key.gpg \
| sudo gpg --dearmor -o /usr/share/keyrings/easysys.gpg
echo "deb [signed-by=/usr/share/keyrings/easysys.gpg] https://repo.easysys.io/easydc/stable/debian ./" \
| sudo tee /etc/apt/sources.list.d/easydc.list
sudo apt update
sudo apt install easydc
sudo systemctl enable --now easydc
For air-gapped hosts, grab the .deb or .rpm for your architecture from the
releases page:
sudo dpkg -i easydc_*_amd64.deb # or _arm64.deb
sudo rpm -i easydc-*.x86_64.rpm # or .aarch64.rpm
sudo systemctl enable --now easydc
Upgrades then mean downloading the next package by hand — the repository is the easier path where the host has network access.
Already using another EasySYS product, such as EasyLog? The key is the same, so
/usr/share/keyrings/easysys.gpg is already in place — add only the easydc repository
line.
What the package installs
| Binary | /usr/bin/easydc |
| Service | easydc.service, running as the easydc system user |
| Database | /var/lib/easydc/easydc.db, in a directory only the service user can read |
| Port | 3000 — set EASYDC_PORT in /etc/default/easydc (Debian) or /etc/sysconfig/easydc (Red Hat) to change it |
The database holds the EasyDC logins, the audit log and the bind password of every
domain controller you add, which is why its directory is mode 0700.
A fresh install does not start the service — systemctl enable --now easydc does. An
upgrade restarts the service if it was running, so the new version takes effect. Removing
the package stops and disables the service but leaves /var/lib/easydc and the
easydc user in place: they are your data.
Upgrading
Upgrades come through the package manager like any other package:
A running service is restarted onto the new version; a stopped one is left stopped.
easydc --version shows which version is installed, and the version is also in the footer
of every page once you are signed in.
To remove EasyDC, sudo apt remove easydc or sudo dnf remove easydc stops and disables
the service. /var/lib/easydc and the easydc user are kept — they hold your database —
so delete them yourself if you are removing EasyDC for good.
Moving from a manual install
If EasyDC already runs as a service you set up by hand — from the old README recipe, or a
binary in /opt or anywhere else — installing the package moves it over for you
(from 0.3.1; with 0.3.0, follow the steps below).
It looks for a hand-made unit at /etc/systemd/system/easydc.service that runs something
other than /usr/bin/easydc. That unit matters because systemd reads /etc before the
package's own unit, so left alone it would keep starting the old binary. When it finds one,
the install:
- stops the old service;
- copies
easydc.dbfrom the old unit's working directory into/var/lib/easydc, owned by theeasydcuser — unless a database is already there; - keeps a
--portfrom the old command line, in/etc/default/easydcor/etc/sysconfig/easydc; - disables the old unit and renames it to
easydc.service.pre-package; - starts the packaged service if the old one was running.
Nothing is deleted. The old binary, database and unit stay where they were, so you can check everything and remove them later — or go back. The install prints each step, and afterwards
should show /usr/lib/systemd/system/easydc.service. Log in with your existing account and
your servers should all be there.
The step runs on every install and upgrade and does nothing when there is nothing to move;
run /usr/share/easydc/migrate-legacy yourself to repeat it. A unit in
/etc/systemd/system that already runs /usr/bin/easydc is taken as a deliberate
override and left alone.
By hand
On 0.3.0, or to do it yourself, first see what the old service runs and where it keeps its
database — the WorkingDirectory line, or / if there is none:
Then, as root, with /opt/easydc standing in for that directory:
systemctl stop easydc && cp -a /opt/easydc /opt/easydc.bak
install -d -o easydc -g easydc -m 700 /var/lib/easydc
cp /opt/easydc/easydc.db* /var/lib/easydc/
chown easydc:easydc /var/lib/easydc/easydc.db* && chmod 600 /var/lib/easydc/easydc.db*
systemctl disable easydc && rm /etc/systemd/system/easydc.service && systemctl daemon-reload
systemctl enable --now easydc
If the old ExecStart had --port, put the same port in /etc/default/easydc (Debian) or
/etc/sysconfig/easydc (Red Hat) as EASYDC_PORT=… before the last line.
Without a package
On a distribution outside both families — the binary is static, so any will do — or to try EasyDC out, the bare binary is on the releases page too:
Run it in place:
It listens on port 3000 on all interfaces and creates easydc.db in the current
working directory. To use a different port, pass --port or set EASYDC_PORT; the
flag wins:
./easydc --help lists the options, and ./easydc --version prints the version. For a permanent install without a package, the
unit the package ships
is a good starting point.
Put TLS in front of it
EasyDC serves plain HTTP on port 3000. Anywhere beyond a trusted management network, publish it through a TLS reverse proxy — EasyWAF, Nginx or Caddy all work — and firewall port 3000 to the proxy.
Two separate TLS links
The proxy protects the browser → EasyDC connection. The EasyDC → domain controller
connection is protected by using an ldaps:// URL when you add the server.
First run
Open http://<host>:3000/. On a fresh install you are sent to /setup to create the
admin account; after that every page requires a login.
Next: create the admin account and add your first domain controller.