# Create your first pool & Enroll your first member

## Create your first pool

### Step 1 — Add pool

1. Go to <span class="font-semibold" data-streamdown="strong">Pools</span> → <span class="font-semibold" data-streamdown="strong">Add pool</span>
2. Choose the <span class="font-semibold" data-streamdown="strong">HAProxy template</span>
3. Name the pool (e.g. `production-edge`)
4. After create, you land in the pool with a setup banner

### Step 2 — Connect DNS (Settings)

ServerCTL needs API access to authoritative DNS to create/update the failover <span class="font-semibold" data-streamdown="strong">A record</span>.

<span class="font-semibold" data-streamdown="strong">Cloudflare</span>

- API token: <span class="font-semibold" data-streamdown="strong">Zone · DNS · Edit</span> (+ zone read)
- Cloudflare <span class="font-semibold" data-streamdown="strong">Account ID</span>
- Select the zone that will host your public hostname

<span class="font-semibold" data-streamdown="strong">cPanel / WHM</span>

- WHM hostname and port (usually 2087 or 443)
- WHM username + API token
- Zone domain (apex), e.g. `<span class="md-inline-path-filename">example.com</span>`

You can save reusable Cloudflare credentials under <span class="font-semibold" data-streamdown="strong">Settings → API providers</span> and link them to pools without re-entering tokens.

### Step 3 — Enrol the first member

On <span class="font-semibold" data-streamdown="strong">Overview</span> → <span class="font-semibold" data-streamdown="strong">Add member</span>:

<div class="ui-scroll-area" data-direction="horizontal" data-scroll-padding="4" data-visibility="hover" id="bkmrk-field-notes-member-t"><div class="ui-scroll-area__viewport"><div class="ui-scroll-area__content"><table><thead class="bg-muted/80" data-streamdown="table-header"><tr class="border-border border-b" data-streamdown="table-row"><th class="whitespace-nowrap px-4 py-2 text-left font-semibold text-sm" data-streamdown="table-header-cell">Field</th><th class="whitespace-nowrap px-4 py-2 text-left font-semibold text-sm" data-streamdown="table-header-cell">Notes</th></tr></thead><tbody class="divide-y divide-border bg-muted/40" data-streamdown="table-body"><tr class="border-border border-b" data-streamdown="table-row"><td><div class="md-table-cell-content"><span class="font-semibold" data-streamdown="strong">Member template</span></div></td><td><div class="md-table-cell-content"><span class="font-semibold" data-streamdown="strong">HAProxy balancer</span></div></td></tr><tr class="border-border border-b" data-streamdown="table-row"><td><div class="md-table-cell-content"><span class="font-semibold" data-streamdown="strong">Hostname</span></div></td><td><div class="md-table-cell-content">Must match JSON `hostname` from the agent; set `BALCTL_HOSTNAME` on the VM if OS hostname differs</div></td></tr><tr class="border-border border-b" data-streamdown="table-row"><td><div class="md-table-cell-content"><span class="font-semibold" data-streamdown="strong">Allowed source IPs</span></div></td><td><div class="md-table-cell-content">VM <span class="font-semibold" data-streamdown="strong">outbound</span> IPv4 to `<span class="md-inline-path-filename">serversctl.com</span>` (egress), not necessarily SSH address</div></td></tr></tbody></table>

</div></div></div>After creating, copy the <span class="font-semibold" data-streamdown="strong">one-shot install command</span> **immediately and run it in the HAProxy Server** — the enrollment secret is shown <span class="font-semibold" data-streamdown="strong">once</span>.

The command:

- Downloads the agent bundle
- Runs `balctl-agent.sh --enrol --key … --hostname …`
- Writes `<span class="md-inline-path-prefix">/etc/balctl/</span><span class="md-inline-path-filename">agent.env</span>`
- Installs and starts `<span class="md-inline-path-filename">balctl-heartbeat.service</span>`

Within a few seconds, the member tab should show a green heartbeat.

### Step 4 — Set the public failover hostname

<span class="font-semibold" data-streamdown="strong">Settings</span> or <span class="font-semibold" data-streamdown="strong">Managed DNS</span> tab:

- Set DNS label (e.g. `lb` → `<span class="md-inline-path-filename">lb.example.com</span>`)
- Choose orange-cloud (proxied) vs DNS-only as needed
- On Overview, <span class="font-semibold" data-streamdown="strong">Make active</span> on the member that should receive traffic

### Step 6 — Add a standby (High Availability)

Repeat enrollment on a second VM. Enable <span class="font-semibold" data-streamdown="strong">Automatic failover</span> in Settings when ready for unattended promotion.