Install SafeSquid on the Right Platform

Installation quality determines whether SafeSquid can inspect traffic safely under production load. Pick the deployment method that matches your ownership model, then verify service health before routing users.

Choose the install path

Choose SafeSquid Appliance Builder

SafeSquid Appliance Builder

Build a new VM or hardware appliance from the standard ISO. Use this when the target disk can be dedicated to SafeSquid.

Confirm the VM or hardware can be rebuilt and the selected disk is disposable.If existing data must be preserved, do not use Appliance Builder.

Choose cloud deployment

Cloud Deployment

Place SafeSquid near cloud workloads, remote sites, or hybrid egress with restricted security groups and route-table ownership.

Confirm route tables and security groups restrict proxy access to approved clients.If the proxy is public, tighten source networks before rollout.

Choose Linux Server Install

Linux Server Install

Install on an existing supported Linux host when your team owns OS hardening, monitoring, dependency lifecycle, and rollback.

Confirm host lifecycle, packages, monitoring, and rollback are already owned.If dependencies fail, correct the baseline or rebuild with Appliance Builder.

Match the method to your environment

Environment	Method	Why
New bare metal server	SafeSquid Appliance Builder	Turnkey image with hardened OS and all dependencies
New VM on VMware, Hyper-V, or KVM	SafeSquid Appliance Builder	Pre-configured networking, monitoring, and DNS
Private cloud on OpenStack or Proxmox	SafeSquid Appliance Builder	Complete appliance for self-managed infrastructure
AWS, Azure, GCP, or DigitalOcean	Cloud Deployment	Cloud-optimised images and cloud-init support
Existing Linux server	Linux Server Install	Minimal footprint; you keep ownership of the OS and services

If the environment is not listed, choose by ownership rather than by platform: Appliance Builder when SafeSquid can own the whole host, Linux Server when something else already does.

Installation sequence

Validate prerequisites

Confirm host resources, static addressing, DNS, NTP, firewall rules, and activation key readiness in Deployment Checklist.Confirm prerequisite evidence is attached to the deployment record.If a prerequisite is missing, block installation until the owner corrects it.

Install using the selected path

Build the appliance, launch the cloud instance, or install on the managed Linux host according to the selected deployment model.Confirm the installed host matches the approved deployment model and asset record.If installation assumptions differ from the plan, stop and select the correct install path.

Verify service and listener state

Confirm SafeSquid service health and the approved proxy listener before any managed rollout.Confirm service status and listener output show SafeSquid is ready for activation.If listener state is missing, inspect service logs and network binding configuration.

Route one pilot client

Send one browser or test client through SafeSquid and prove that traffic appears in /var/log/safesquid/access/extended.log.Confirm the access log records source, destination, timestamp, and action.If no log appears, recheck proxy settings and bypass rules before adding users.

Open the interface and activate

Open http://safesquid.cfg/ through the proxy path, then complete Activate Your License.Confirm the Configuration Portal loads and activation evidence is captured.If the portal fails, confirm the pilot browser uses SafeSquid as proxy.

Evidence to capture

Store:

Install method and version source.
Hostname, IP address, and deployment environment.
CPU, RAM, disk, and NIC allocation.
Service status output.
Listener check for the approved proxy port.
Pilot client test and first access-log entry.
Rollback or rebuild procedure.

Troubleshoot install choice

Symptom	Likely cause	Fix
Installer path is disputed	Ownership model is unclear	Use Appliance Builder for new appliances; use Linux only when OS lifecycle is already owned
Cloud proxy is reachable from the internet	Security group is too broad	Restrict source networks before any client rollout
Existing Linux host fails dependencies	Baseline OS differs from supported assumptions	Fix dependencies or rebuild with Appliance Builder

Next steps

Deployment Checklist - confirm install readiness.
SafeSquid Appliance Builder - build a standard appliance.
Connect Your Client - route the first pilot client.

Plan and prepare