Bring Your Own Cloud (BYOC)

Bring Your Own Cloud (BYOC) puts the infrastructure in your hands. Instead of renting capacity from us, you create the server in your own cloud account — on your own bill — and Espresso connects to it over SSH to deploy and manage your ERPNext workloads.

Because the server is yours, you get:

• Full access to the machine you're paying for. Your account, your credentials, your data, root and all.
• No lock-in. Espresso only manages the platform layer — CI/CD, environments, deploys. The infrastructure stays under your control, and you can revoke our access at any time.
• Freedom to run anything else on it, too. The same server can host your other applications, databases, and side projects alongside Espresso. It's a server you own — not a sandbox we rent you.

That's the whole idea behind BYOC: you own and control the box; we just bring ERPNext to it.

This guide takes you from an empty cloud account to a server connected to Espresso. Plan for about 10–15 minutes.

Overview

1. Provision a server — spin up a VPS that meets the minimum specs.
2. Open the firewall — allow SSH from Espresso, plus HTTP/HTTPS for your sites.
3. Run the setup script — one command installs Docker, creates the espresso user, and authorizes our key.
4. Connect from the dashboard — enter the server's IP and test the connection.

Step 1 — Provision a server

Create a VPS (or use any machine you already own) that meets at least these specs:

Resource	Minimum
vCPU	2 cores
Memory	4 GB RAM
Disk	30 GB
OS	Ubuntu 24.04 LTS (or the latest LTS)

Size up for production

These are floor specs to get ERPNext running. For production traffic, more RAM and disk will serve you better — and since it's your server, you can resize it whenever you need to.

Any provider works. Here's the official "create a server" documentation for some popular ones:

• Hetzner Cloud — Creating a Server
• DigitalOcean — How to Create a Droplet
• Vultr — Provision a Cloud Compute Instance
• Amazon Web Services (EC2) — Get started with Amazon EC2
• Google Cloud (Compute Engine) — Create and start a VM instance
• Microsoft Azure — Create a Linux VM in the portal

When prompted, pick Ubuntu 24.04 as the image and add your own SSH key so you can log in. Note down the server's public IP address — you'll need it in Step 4.

Step 2 — Open the firewall

Espresso connects to your server over SSH, and your ERPNext sites are served over HTTP/HTTPS. Make sure these inbound ports are reachable:

Port	Protocol	Allow from	Purpose
22	TCP	91.99.127.193/32 and your own IP	SSH — Espresso deploys; you administer
80	TCP	0.0.0.0/0	HTTP — site traffic + Let's Encrypt validation
443	TCP	0.0.0.0/0	HTTPS — secure site traffic

The critical one is port 22. It must be open and reachable from Espresso's connection IP, 91.99.127.193/32, and from your own IP (or everywhere) so you can SSH in to run the script in the next step.

Espresso connects from a single, fixed IP

Espresso reaches your server only from 91.99.127.193/32. If this ever needs to change, we'll send you the new value in advance — you won't have to guess.

How you open ports depends on where your firewall lives:

• Cloud firewall / security group (recommended) — most providers have one in the console (AWS Security Groups, Hetzner Cloud Firewall, DigitalOcean Cloud Firewall, Vultr Firewall, …). Add inbound rules for ports 22, 80, and 443 using the sources in the table above. Many providers let you set these while creating the server in Step 1.
• On-server firewall (ufw) — if you manage the firewall on the machine itself:

sudo ufw allow from 91.99.127.193/32 to any port 22 proto tcp   # Espresso SSH
sudo ufw allow 22/tcp                                            # your own SSH (or restrict to your IP)
sudo ufw allow 80/tcp                                            # HTTP
sudo ufw allow 443/tcp                                           # HTTPS
sudo ufw enable

Don't lock yourself out

If you restrict port 22 to specific IPs, double-check your own current IP is allowed before enabling the firewall — otherwise you'll lose SSH access to the server.

Step 3 — Run the Espresso setup script

SSH into the server you just provisioned, as your admin user:

ssh root@<your-server-ip>

Then download and run the Espresso setup script. It needs root, so run it with sudo:

curl -fsSL https://espresso.zimplify.tech/byoc-setup.sh -o espresso-byoc-setup.sh
sudo bash espresso-byoc-setup.sh

That single command handles the entire server-side setup. Here's exactly what the script does:

1. Installs Docker Engine using Docker's official installer (curl -fsSL https://get.docker.com -o get-docker.sh followed by sh get-docker.sh).
2. Creates a dedicated espresso user with no password — key-based login only.
3. Grants that user Docker access by adding it to the docker group, so Espresso can build and run containers, including ones bound to ports 80 and 443.
4. Authorizes Espresso's public SSH key by adding it to /home/espresso/.ssh/authorized_keys, so the platform can connect.

It does not open firewall ports, install ERPNext, or touch any of your other applications or users.

Read it before you run it

Running a script as root deserves a look first — we encourage it. Open and read byoc-setup.sh: it's short, commented, and does exactly the four things listed above.

For transparency, the public key the script authorizes is:

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIC1/s/7dvopaVxaQRUh9n36fcB0OggEmzGDeeQa7J4E4 cloud@tacten.co

The matching private key never leaves Espresso's infrastructure, and you can revoke it at any time (see Revoking access).

Step 4 — Connect from the Espresso dashboard

With the server provisioned, the firewall open, and the script run, head back to your Espresso dashboard:

1. Open the BYOC section and choose to add a server.
2. Enter the server's public IP address (the one you noted in Step 1).
3. Click Test connection.

Espresso will SSH in as the espresso user, run docker version, and confirm everything is wired up correctly. Once the test passes, your server is ready to host ERPNext sites.

Revoking access

Your server, your call. To revoke Espresso's access at any time, remove the authorized key:

sudo sed -i '/cloud@tacten.co/d' /home/espresso/.ssh/authorized_keys

Or remove the user entirely:

sudo deluser --remove-home espresso

Troubleshooting

Symptom	Likely cause	Fix
Test connection fails / connection times out	Port 22 not open to 91.99.127.193/32	Add the inbound rule from Step 2
Permission denied (publickey) in Espresso logs	Script didn't finish, or the key wasn't added	Re-run the script from Step 3
docker: command not found	Docker install didn't complete	Re-run the script and check its output for errors
permission denied while trying to connect to the Docker daemon socket	espresso user not in the docker group	Re-run the script, or run sudo usermod -aG docker espresso
Sites unreachable in a browser	Ports 80/443 not open	Open 80 and 443 to 0.0.0.0/0 (see Step 2)

Need help? Reach out at support@espresso.zimplify.tech with your workspace name and the server's public IP.