Install on a cloud server
Paste a start-up script when you create the server. No SSH needed.
Every major cloud lets you give a new server a start-up script that runs once, as root, on its first boot. Paste ours there and the server installs Talos by itself. Log in later and the login message tells you the result.
Where it goes: DigitalOcean → “Add initialization scripts”; Hetzner → “Cloud config”; AWS EC2 → Advanced details → “User data”; Azure → Advanced → “Custom data”; Google Cloud → Metadata, key startup-script; Vultr and Linode → “User data”. For providers that expect the cloud-config format there is cloud-config.yaml next to it, with the same script inside.
Size
2 vCPU and 4 GB of memory is a good size. On a smaller server the installer still continues (no one is there to answer its questions), but Talos will have little spare capacity.
The address to open
Inside the server the installer only sees its private address, so open Talos at http://<the server’s public IP>:3000. To get links in emails right, set TALOS_URL at the top of the script before pasting it, e.g. TALOS_URL=http://203.0.113.10:3000 or your domain.
The firewall
AWS security groups, Azure network security groups and Google Cloud firewall rules block port 3000 until you open it in the provider’s console; a script on the server cannot do this. Open 3000 only; the API port 3001 does not need to be public. If the server runs its own firewall (ufw, firewalld), open 3000 there too.
Watching it and checking the result
Every login shows the result: the link and, until the first account exists, the setup token (to root; other users are given the sudo command to read it). If the install failed, the login message says FAILED, with the reason and the log to look at. Fix the cause and run it again: sudo sh /root/talos-install.sh --yes --motd. Remove /etc/profile.d/talos.sh to stop the message.
The setup token matters most here: a new server is on a public address within minutes, and bots look for unclaimed first-run pages. Without the token they cannot create the first account.
It checks what it runs
The script verifies the installer it downloads against a checksum written into the script itself, and refuses to run a download that does not match. During the first boot it also waits for the server’s own automatic updates to release the package manager before installing Docker.