Gen3 Self Hosted Install Cloudflare - GT-Edge-AI/GT-AI-OS GitHub Wiki

Install — Cloudflare

Install GT AI OS on a single host so internet users reach Control Panel and the tenant app on public hostnames through a Cloudflare Tunnel.

← Back to installation hub

Prerequisites

  • Cloudflare account with DNS zones for your two public hostnames
  • Cloudflare API token and account ID (create and test in section 1 below)
  • Outbound HTTPS to GitHub Releases, ghcr.io/gt-edge-ai, and Cloudflare
  • Shared prerequisites

1. Cloudflare API token and account ID

Complete this section on any machine with a browser (or on the install host) before you run the operator.

1.1 Create the API token

  1. Log in to the Cloudflare dashboard.
  2. Open My Profile (in the top right) → API Tokens.
  1. Click Create Token → Create Custom Token.
  2. Name the token (for example gt-ai-os-commercial).
  3. Add permissions:
    • Account → Cloudflare Tunnel → Edit
    • Zone → Zone → Read
    • Zone → DNS → Edit
  1. Under Account Resources, include the account that will own the tunnel.
  2. Under Zone Resources, include the zones for your Control Panel and tenant hostnames.
  3. Create the token and copy it once (Cloudflare will not show it again).

For government Cloudflare, use your government account and zones only. Do not reuse commercial tokens or account IDs.

1.2 Find the account ID

The easiest way to do this is using Cloudflare Search as shown:

  1. In the same Cloudflare account, open any DNS zone you will use.
  2. On the zone Overview page, find Account ID in the API box (right side).
  3. Copy that value. It is the account ID, not a zone ID.

1.3 Test token and account ID

export CLOUDFLARE_API_TOKEN="<your-api-token>"
export CLOUDFLARE_ACCOUNT_ID="<your-account-id>"

curl -fsSL \
  -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
  "https://api.cloudflare.com/client/v4/accounts/${CLOUDFLARE_ACCOUNT_ID}" \
  | python3 -m json.tool

Good: JSON with "success": true.

If that fails, list accounts the token can access:

curl -fsSL \
  -H "Authorization: Bearer ${CLOUDFLARE_API_TOKEN}" \
  "https://api.cloudflare.com/client/v4/accounts" \
  | python3 -m json.tool

Use the id from the correct account in the install wizard.

You can also use this command to fix the token if it has been inputted incorrectly into AI OS. (replace the values with your own)

sudo gt-ai-os-admin auth cloudflare \
  --profile commercial \
  --api-token 'PASTE_TOKEN_HERE' \
  --account-id 'ACCOUNT_ID_HERE'

2. Install the Quick Installer

To pin a release, set TAG before download (for example TAG=v3.0.3). The .deb filename uses semver without the v prefix (3.0.3 for tag v3.0.3).

TAG="$(curl -fsSL https://api.github.com/repos/GT-Edge-AI/GT-AI-OS/releases/latest | grep '"tag_name"' | head -1 | cut -d'"' -f4)"
VER="${TAG#v}"
curl -fsSL -o /tmp/gt-ai-os.deb \
  "https://github.com/GT-Edge-AI/GT-AI-OS/releases/download/${TAG}/GT-AI-OS-Quick-Installer_${VER}_all.deb"
sudo apt install -y /tmp/gt-ai-os.deb
sudo -E gt-ai-os-operator

3. Operator menu

When the operator menu appears, choose the following:

When you see Choose
What do you want to do? 1 (Install)
Install — choose style 1 (Interactive)

4. Install wizard

When the install wizard prompts you, choose or enter the following:

When you see Choose or enter
Detected host — use this? Y
Detected architecture — use this package? Y
Kubernetes namespace Your namespace (for example gt-ai-os-prod) or Enter for the default
Choose a release Your release tag (for example v3.0.3)
Deployment edge / access mode 3 (cloudflare-commercial) or 4 (cloudflare-government)
Control Panel public hostname FQDN only (for example ctp.example.com)
Tenant app public hostname FQDN only (for example app.example.com)
How should GT AI OS use Kubernetes? 1 (Auto-detect) on a clean host
Fresh install vs Resume (if RKE2 is already running) 1 Fresh; 2 Resume
Wipe vs Abort (if RKE2 artifacts exist but the API is down) 1 Wipe
Ready to install? y
Cloudflare API token (after you confirm install) Token from section 1.1
Cloudflare account ID ID from section 1.2

After your last answer above, the install runs automatically. Expect about 15 minutes before the wizard finishes. Do not interrupt the terminal.

Save the bootstrap Control Panel email and password printed when the install finishes.

5. Log in to Control Panel

  1. Open https://<control-panel-hostname>/login (the Control Panel hostname from the wizard).
  2. Sign in with the bootstrap email and password from step 4.

To print bootstrap credentials again:

sudo env GT_AI_OS_ADMIN_CONFIG_DIR=/var/lib/gt-ai-os/admin \
  PATH="/var/lib/rancher/rke2/bin:/usr/local/bin:$PATH" \
  gt-ai-os-admin bootstrap-creds --namespace <your-namespace>

Tenant app URL: https://<tenant-hostname>/login

Next step

Self-Hosted Control Panel setup

If there are issues along the way, do a full nuke:

curl -fsSL https://github.com/GT-Edge-AI/GT-AI-OS/releases/latest/download/gt-ai-os-operator.sh -o /tmp/gt-ai-os-operator.sh
chmod +x /tmp/gt-ai-os-operator.sh
sudo -E bash /tmp/gt-ai-os-operator.sh --nuke --yes