Deploy on AWS Lightsail

Not yet tried end to end

Written from the provider’s documentation; not yet tried end to end. If a step differs on your screen, the provider’s own page (linked below) is right, and the Geometer steps after it stay the same.

This guide takes you from nothing to a Geometer server on AWS Lightsail. Geometer charges for assurance (Guard, the signed licence, alerts, the monthly report), not hosting: the server, its bill and your AI key and WhatsApp account are yours. The general steps and what the install does are in Deploy on your server.

What you need

• A Linux/Unix instance, Ubuntu 24.04 (or 22.04), OS only, in the Mumbai (ap-south-1) Region, on the plan with 2 vCPU and 4 GB of memory or larger. That is the bundle’s stated size for about ten shops. See Lightsail pricing for what it costs; Geometer does not host it or bill for it.
• A domain you control, where you can add an A record.
• A Geometer account with a pairing code (step 1), and the release tag Geometer gave you.
• Per shop and for the model, the keys listed in Deploy on your server.

1. Get your pairing code

Sign in at geometer.dev/account, choose Add a server and copy the one-time code (it starts gfp_). It works once and runs out after two hours, so make the server soon after you copy it. The page shows the code only once.

2. Make the server

1. In the Lightsail console choose Create instance.
2. Choose the Mumbai Region and its Availability Zone.
3. Platform: Linux/Unix. Blueprint: OS Only, then Ubuntu 24.04 LTS (or 22.04).
4. Choose the plan with 2 vCPU and 4 GB or larger, name the instance and choose Create instance.

Lightsail also has a launch script box (Add launch script when you create the instance). It takes a shell script run as root. The cloud-init file is written for providers’ cloud-config fields, so on Lightsail use the install command below over SSH instead; that is the path this guide follows.

3. Open the ports

A new Ubuntu instance opens SSH (TCP 22) and HTTP (TCP 80) only, so HTTPS has to be added. In the instance’s Networking tab, under IPv4 Firewall, choose Add rule, choose the HTTPS application type (TCP 443) and save. Leave SSH and HTTP as they are. Rules here only ever allow traffic. Do the same under IPv6 Firewall if you will use an AAAA record.

The address: In the left navigation pane choose Networking, then Create static IP, pick the Mumbai Region and this instance, name it and choose Create. A static IP can only be attached to an instance in the same Region. Without one, the address changes when you stop and start the instance, and your domain would point at the wrong place. Use the static IP in the next step.

4. Point your domain at the server

Create an A record for your domain (for example shops.example.com) with the server’s public address, at whoever holds your domain’s DNS. Do this before the install so the certificate can be issued; the install keeps trying until the record points at the server.

5. Run the install

Log in over SSH as a normal user with sudo (not root), and run the two lines the account page shows after you choose Add a server (the second one already carries your pairing code), with the release tag Geometer gave you in place of <release tag>:

git clone --branch <release tag> https://github.com/GeometerLabs/agents.git ~/geometer/agents
bash ~/geometer/agents/install.sh --pairing-code-file <(printf '%s\n' '<your pairing code>')

It asks for your domain, says what it will do and asks before it changes anything. It takes about ten minutes. (The account page’s lines already carry your pairing code, so it is not asked for again.)

The Guard image is a file for now

The Guard image is not in a public registry yet, so Geometer gives it to you as a file. Without it the install still finishes and the panel starts, but no shop can start. Copy the file to the server (scp) and run the install again with --guard-image-file <the file>: it finds what is there, checks the file against the pinned checksum for your server’s CPU and carries on, and the pairing already kept on the server is reused (no new code). Also, until Geometer names a release, the install stops (a copy with no release named is refused); --use-this-checkout is for a trial only.

6. Check that it works

1. Log in to the server as builder (cloud-init path) or your own user, and run geometer status. It lists each shop (none yet), the Guards and the last backup.
2. Run geometer invite builder and open the one-time sign-in link it prints. The panel opens at https://<your domain>.
3. On geometer.dev/account the server appears under your servers once it is paired.
4. Finish the panel’s first run: the model and its key, the backup bucket and its key, and Google if your shops use a calendar. Then add a shop.

If something is wrong: geometer server logs shows the server’s containers, and Deploy on your server has the rest. For a cloud-init install, the install’s own log is /var/log/cloud-init-output.log on the server.

The provider’s own pages

• Create a Lightsail instance
• Launch scripts for Linux instances
• Instance firewall
• Static IP addresses
• Lightsail pricing