Installing PM Software Stack
PM Software Stack (PMSS) is the seedbox platform Pulsed Media runs on its own servers, published as open source under GPL-3.0. It installs on any Debian 12 server you control, whether a rented dedicated server, a VM or a home-lab box (with a firewall caveat for home LANs, below), with one command. On a 4 vCPU / 6 GB test VM the installer finished in under 7 minutes and took a minimal Debian system from 328 installed packages to 1,472 in a single run.
The install screenshots below come from a real install on a fresh VM, and every gotcha was hit there or checked against the PMSS source.
Requirements
| Item | Requirement |
|---|---|
| Operating system | Debian 12 (Bookworm), minimal install, amd64. Debian 13 support is experimental; Debian 10 is end-of-life. |
| Access | root on the server, over SSH or console |
| Disk layout | /home on its own filesystem. PMSS stores every user under /home, applies disk quotas there and refuses some user operations when /home is not a separate mount.
|
| Free space | At least 2 GiB free on /; the installer checks this before it starts
|
| Hostname | A fully qualified domain name (FQDN) that resolves to the server. nginx, ProFTPD and the Let's Encrypt certificate all use it. |
| Management access | From the console, a public IP or a 10.x network. The PMSS firewall drops all traffic arriving on the uplink from 192.168.0.0/16, 172.16.0.0/12 and 100.64.0.0/10, including an SSH session already in progress (see Gotchas). |
| Tested on | KVM VM with 4 vCPU, 6 GB RAM and a 64 GB disk |
PMSS is a whole-server platform, not an app you add to an existing desktop or web host. Start from a fresh Debian install.
Step 1: Install Debian 12 minimal
Boot the Debian 12 netinst image and go through the installer normally. Three screens matter.
Hostname and domain. Enter the short name (for example seedbox) and your domain (example.com). The installer writes only the short name to /etc/hostname; the PMSS installer asks for the full FQDN later.
Partitioning. Choose Guided - use entire disk, then Separate /home partition. This gives the separate /home filesystem PMSS needs without manual partitioning.
On the 64 GB test disk this produced a 21.8 GB root, 1 GB of swap and a 41.6 GB /home. On a real seedbox, put most of the space on /home; that is where user data lives.
Software selection. Watch this screen. Debian's default ticks a desktop environment (GNOME) and leaves SSH server unticked.
Untick the desktop entries and tick only SSH server and standard system utilities.
Finish the install and reboot into the new system. A minimal netinst has wget but no curl, git or PHP; the PMSS installer adds what it needs.
Step 2: Download and run the installer
Before you start: the firewall goes up during the install. If you are connected over SSH from a 192.168.x.x, 172.16-31.x.x or 100.64-127.x.x address, the connection drops partway through. Run the install from the server console instead, or connect from a public IP or a 10.x network.
Log in as root and download the installer, then run it with the git/main channel:
wget -qO pmss-install.sh https://github.com/MagnaCapax/PMSS/raw/main/install.sh bash pmss-install.sh git/main
git/main installs the current main branch, the same branch Pulsed Media updates its own servers from. Running the script with no argument installs the latest tagged release instead. Downloading first and then running keeps the script on disk where you can read it before it touches your system.
Early on, the installer opens /etc/hostname in nano. Replace the short name with the full FQDN, then save with Ctrl+O and exit with Ctrl+X.
The rest runs unattended: the PMSS files are staged, the full package set is installed in one pass, rTorrent and libtorrent are compiled from source, and nginx, ProFTPD, the firewall and the user skeleton are configured. On the test VM the git/main install finished in just under 7 minutes; a default release install on an identical VM took 6 minutes 44 seconds.
For unattended installs, flags such as --hostname= and --non-interactive skip the prompts; --non-interactive also skips the quota setup (see Gotchas). The full flag list is on the PM Software Stack page.
Step 3: Reboot
Reboot once the installer finishes. PMSS adds systemd.unified_cgroup_hierarchy=0 to the GRUB command line, and that only takes effect after a reboot. Before it, /sys/fs/cgroup is a cgroup2 filesystem; after it, the cgroup v1 layout PMSS uses for per-user resource limits is active.
reboot # after it comes back: grep -o 'unified_cgroup_hierarchy=0' /proc/cmdline stat -fc %T /sys/fs/cgroup # tmpfs after the reboot, cgroup2fs before it
/proc is already remounted with hidepid=2 during the install, so users cannot see each other's processes from the start.
Step 4: Fix-ups after the first reboot
Quotas. The installer's quota check runs before the new /home mount options are active, so after the first reboot quotas are off and the quota files are missing (quotaon.service may report cannot find /home/aquota.user). Run the quota tool once, then check:
php /scripts/util/quotaFix.php quotaon -pa # user and group quota on /home should say "is on"
Trust the quotaon -pa output rather than the tool's exit code; it can report a warning and still leave quotas correctly enabled. From the next boot on, quotas come up by themselves.
Network interface. PMSS ships a default network config naming eth0 as the uplink. Many servers and VMs use a different name (the test VM had ens3). In that case every PMSS firewall rule is bound to an interface that does not exist and protects nothing, including the rules that drop direct connections to ports 8080 and 8112. Set your real interface name and let the updater apply it. Once the rules sit on the real uplink, the private-range drops apply too, so do this from the console or from an address outside those ranges:
ip -br link # find your uplink, e.g. ens3 nano /etc/seedbox/config/network # set 'interface' => 'ens3' php /scripts/update.php git/main iptables -S INPUT | grep -c -- '-i ens3' # more than zero = rules are on the right interface
PMSS creates this file only when it is missing, so the change survives later updates.
Let's Encrypt account email. PMSS requests the certificate with a Pulsed Media no-reply address, and only when no certificate exists yet. If the certificate was issued during the install, move the ACME account to your own address:
certbot update_account --email you@example.com
If issuance failed because DNS was not ready, point the FQDN at the server and run the setup once with your address instead:
/scripts/util/setupLetsEncrypt.php you@example.com
The installer's user account. The Debian installer asks you to create a regular user. PMSS treats every account with a directory in /home as a seedbox user, so that account shows up in PMSS and logs warnings about a missing rTorrent config. On a fresh server its home holds nothing of yours. Remove it with PMSS's own tool, dry run first:
/scripts/terminateUser.php --dry-run sysop /scripts/terminateUser.php --confirm sysop
Replace sysop with the name you chose. Make sure you can log in as root over SSH first.
Step 5: Create your first seedbox user
/scripts/addUser.php alice rand 1024 200
The arguments are username, password, RAM in MiB and disk quota in GiB. rand asks PMSS to generate a random password. Usernames must be lowercase, 3 to 8 characters, starting with a letter. Run /scripts/addUser.php --help for traffic limits and the other options.
The user's web panel is at https://seedbox.example.com/user-alice/. rTorrent with the ruTorrent web interface is on by default.
Keeping it updated
php /scripts/update.php git/main
This pulls the current PMSS and re-applies the configuration. Pulsed Media's own servers are updated the same way.
Gotchas
The old install URL
Older guides point at pulsedmedia.com/remote/install.sh. That script dates from the Debian 7 era and does not install current PMSS. Use the GitHub URL above.
IPv6 is disabled
PMSS sets net.ipv6.conf.all.disable_ipv6 = 1 system-wide. Plan for IPv4 access.
Home-lab installs behind NAT
The PMSS firewall drops every packet arriving on the uplink from private source ranges 192.168.0.0/16, 172.16.0.0/12 and 100.64.0.0/10, among other bogon ranges, before any other rule. Established connections are not exempt. 10.0.0.0/8 is not on the list. On a home LAN using 192.168.x.x, machines on that LAN cannot reach the server once the firewall is active: no SSH, no web panel. Manage it from the console, from a 10.x network, or through its public address.
Quotas are off after the first reboot
Expected. See Step 4.
Unattended installs skip the quota setup
--non-interactive skips the quota prompt and the /home quota options with it. On a test VM installed that way, /home came up after the first reboot with no quota options. The fix that worked: run php /scripts/update.php git/main (it adds the options to /etc/fstab), reboot once more, then run quotaFix.php as in Step 4. Check mount | grep ' /home ' for usrjquota before you create users.
Let's Encrypt fails during the install
Expected when the FQDN does not resolve to the server yet; the install finishes without a certificate. Run /scripts/util/setupLetsEncrypt.php you@example.com once DNS is in place.
FAQ
Is PMSS free to use on my own server?
Yes. PMSS is GPL-3.0 and its README states it can be used standalone, without a server from Pulsed Media. The source is at github.com/MagnaCapax/PMSS.
Does Pulsed Media support self-hosted installs?
Not for free. Pulsed Media does not provide support for PMSS on your own servers without a fee, unless the server was bought from Pulsed Media. The PMSS README points self-hosters to the Pulsed Media Discord for guidance.
git/main or the default release?
This guide uses git/main, the branch Pulsed Media's own fleet runs. The default channel installs the latest tagged release, which can lag behind main.
Can I run it in a VM?
Yes. The install screenshots here come from a KVM VM. Give it a separate /home disk or partition like any other install.
How long does it take?
Under 7 minutes on the 4 vCPU test VM. Installing the package baseline took about 2.5 minutes of that, the largest single step. Slower CPUs and mirrors take longer.
Rather not run the hardware?
Every Pulsed Media seedbox runs this same PMSS stack on Pulsed Media's own servers in Finland, with the updates, monitoring and support handled for you. To build your own anyway, Build Your Own Seedbox covers choosing hardware for it.
See also
- PM Software Stack — architecture, installer flags and feature list
- Build Your Own Seedbox — choosing hardware for a self-hosted seedbox
- Debian — the operating system PMSS is built on
- Seedbox — Pulsed Media seedbox plans running PMSS
- Pulsed Media — company overview