---
title: Quickstart
description: Go from signup to a running site with a permanent host and optional custom domain.
audience: user
status: current
last_updated: 2026-09-28
order: 10
related:
  - /v/docs/concepts/sites-and-deploys.md
  - /v/docs/ui/building-an-image.md
  - /v/docs/getting-started/api-tokens.md
  - /v/docs/concepts/tcp-edge.md
---

This is the shortest browser path from a new account to a live site. The REST
API and CLI expose the same site and deploy model.

## 1. Sign up and verify your email

Create an account and choose a namespace of 3–32 lowercase letters, numbers, or
hyphens. It must begin and end with a letter or number and cannot be a platform
reserved name. Open the verification link sent to your mailbox.

## 2. Confirm your namespace

Your personal namespace is permanent. If you chose `mike`, every site host ends
in `.mike.serverl3ss.com`. Organization sites use the organization slug instead;
your role in that organization controls which changes you can make.

## 3. Create a site

Open **My Sites**, choose **Create site**, and enter a name and available slug.
Olibato reserves the host immediately. For example, slug `web1` in namespace
`mike` becomes:

```text
web1.mike.serverl3ss.com
```

The site can remain a draft until you attach a deploy source.

## 4. Deploy a container

Choose the container-image source and provide an immutable digest when possible:

```text
docker.io/library/nginx@sha256:<digest>
```

Confirm the public HTTP service and port, start the deploy, and follow its build
events. Olibato validates the manifest and runtime before marking the resulting
version ready. A successful deploy becomes the site's active version without
changing its host.

You can use a GitHub repository, committed local source, or an app template
instead. Repository and local-source deploys use the same build and version
history; app templates collect their required parameters before entering that
pipeline.

## 5. Visit the site

Open the permanent host from the site detail page. A sleeping site wakes on the
first authorized request and can scale back to zero after its idle period while
retaining its configured state.

## 6. Add a custom domain

In **Custom domains**, add a hostname such as `app.example.com`. Publish both DNS
records shown by Olibato:

- the TXT record proves ownership;
- the CNAME points traffic to the permanent site host. An edge A record may be
  accepted where the dashboard explicitly offers it.

Keep Cloudflare records DNS-only. Choose **Verify DNS** after the public records
propagate. Olibato adds the route and requests a dedicated certificate; the
domain becomes active when certificate issuance completes.

## Automate later deploys

Create a **Write** token under **Account → API access**, then authenticate the
CLI:

```bash
olibato login --token "oli_pat_…"
olibato push . --site web1
```

The CLI packages committed `HEAD`; dirty and untracked files are ignored and
reported. For headless jobs, provide `OLIBATO_TOKEN` through the job's protected
secret store. See [API tokens](/v/docs/getting-started/api-tokens/) and the
[REST API guide](/v/docs/api/).

## Connect a private service

Install a template or deploy a manifest with an explicit service `protocol`.
Create a temporary TCP access grant from the IP where the client will run, then
read the returned service hostname, port, expiry, and readiness. Application
credentials are separate from your API token. An unverified endpoint is not
evidence that the service is externally reachable.

**Implemented edge:** the Envoy edge and MySQL gateway are deployed. Use these
client settings; `tcp-access` returns a MySQL URI with its routing
username, and generic `tcp://` for other protocols.

| Service | Connection settings |
| --- | --- |
| PostgreSQL | Service hostname on 5432 with SNI and the database username/password. The stream passes through byte for byte: TLS exists only when the database itself has `ssl` enabled (the seeded template currently serves plaintext, so `sslmode=prefer` negotiates down). |
| MySQL/MariaDB | Gateway on 3306, hostname-verified TLS, and the resolved site-unique routing username. Omit the template username parameter to render `u_{{ site.token }}`; read the concrete username from the resolved manifest and owner credentials. |
| Redis/Valkey | Service hostname on 443, TLS and SNI, trusted CA, ACL user `app`, and the generated password. Use `rediss`, never plaintext Redis. |
| AMQP | Service hostname on 5671, `amqps`, hostname-verified TLS, and application credentials. |
| Other client-first TLS services | Service hostname on 443 with SNI, verified TLS, and an approved protocol binding. |

See [TCP edge](/v/docs/concepts/tcp-edge/) for client commands and stage status.
Service ports inside the runtime do not select external ports.

Connections close when an instance is recycled, including checkpoint/restore or
idle scale-to-zero; configure the client to reconnect. Configured durable state
persists. Keepalives keep the instance awake and that time is billable.

## Private-beta boundary

Olibato is a guided private beta with changing limits and no committed
service-level agreement. Review access, quota, backup, and recovery needs before
placing important workloads on a site.