10 minute read  

Getting Started

How do you deploy and set up SelfPrivacy server?

The SelfPrivacy server is created step by step within an hour. Sounds scary, but believe me, you don’t need a PhD to do it. It’s as easy as shopping in an e-shop.

  • Finding a passport and card with a balance of $10-15 and $5 per month
  • Registration of accounts
  • Domain purchasing
  • Connecting Domain to DNS Server
  • Generating tokens
  • Installation
  • Connecting to the services

If you delegate this process to someone else, you will lose your privacy. For 100% independence and control we recommend doing everything yourself.

Accounts registration

For stability, SelfPrivacy needs many accounts. We don’t want to trust all the data to one company, so we’d rather distribute parts of the system to different places.

Accounts to create

  • Hetzner or DigitalOcean — virtual hosting servers. Whichever one you choose, your data and SelfPrivacy services will live on it.
  • Any domain registrar, such as Porkbun (cryptocurrency payments accepted), to purchase your personal address on the Internet — the domain that will point to the server.
  • For DNS server where your domain operates, choose from: deSEC, DigitalOcean DNS, or CloudFlare (not recommended).
  • Backblaze — an IaaS provider, for storing your encrypted backups.

Registration is trivial, but sometimes account activation can take up to several days or require additional documents. Therefore, use real documents and fill everything out carefully. Providers protect themselves from spam this way, nothing personal :)

Be sure to enable additional account protection — the second factor (MFA, 2FA). Without this simple step, your data will not be safe.

I know it was hard, but now your data is better protected than 95% of users. You should be proud of yourself! I’m proud of you 🤗

Purchasing a Domain

Enabled 2FA? Seriously! Let’s move on to the interesting part!

Domain — it’s a piece of the Internet that you can name. The potential for creativity is enormous, you’re allowed up to 63 characters + several hundred variations of domain extension such as .com, .org, .icu, etc.

Visit your domain registrar. As an example, we will use Porkbun.

Select a domain. You could opt for something simple like your surname, such as smith.live or doe.health, or go for something more creative like oops-happens.shop.

Recommendations

  • Always check the annual renewal price, as it can significantly exceed the initial purchase cost.
  • A normal domain price is $8-10 per year.
  • When registering a domain, you must provide a real email and phone number, otherwise, your registration could be revoked. If you can’t renew the domain, the system will not function as intended.
  • Choose a name that’s easy to dictate over the phone and to put on a business card.
  • Did I mention 2FA?

Connecting Domain to DNS Server

If you chose deSEC: How to add a domain

  1. Go to this link and log in to your account.

  2. Click on the plus button.

  1. Enter your domain name. Click Save.

  2. Copy the names obtained in the Nameservers field.

For the example domain cat-meowmeow.corp, we obtained the nameservers: ns1.desec.io and ns2.desec.org. The nameservers you receive might be different.

If you chose Cloudflare: How to add a domain

  1. Go to this link and log in to your account.

  2. On the left menu, click Websites, then the blue Get started button.

  1. Select the Free plan and click Continue.
  1. On the Review DNS records tab, don’t change anything. Click Continue.
  1. In step 3, copy the nameservers. Then click Continue.
  1. On the final page, click Finish later.

Just now we selected the free plan and obtained the nameservers: alberto.ns.cloudflare.com and michelle.ns.cloudflare.com. The nameservers you receive might be different.

If you chose DigitalOcean DNS: How to add a domain

If you plan to use DigitalOcean for both the server and DNS (which we do not recommend), you will need to create a separate project (in the DigitalOcean interface) for DNS records.

DigitalOcean provides only tokens that give full access to everything in the project. The token for the server remains on your device, but the token for DNS records will be sent to your new server. If the DNS token has access to the server itself, in the event of a breach, the attacker could destroy the server.

  1. Create a new project, then go to manage the new project.

  2. Click the Create button at the top, and select Domain/DNS.

  1. Enter your domain name and select the project created for domain management.
  1. Click Add Domain.

You will get the nameservers, which will be needed in the next step.

Use the obtained nameservers with your registrar

DigitalOcean has a good guide for many popular registrars. Even if you are not using DigitalOcean for DNS, this guide can help you!

Here are the instructions for Porkbun, but you can use your domain registrar; the steps should be roughly similar.

  1. Go to the domain management panel.

  2. Hover over the purchased domain and click DNS.

  3. In the domain management panel, find the Authoritative nameservers setting.

  4. Click Edit.

  5. Enter the nameservers obtained in the previous step.

Within a few minutes or, in the worst case, up to two days, the settings will take effect.

Generating tokens

API tokens are almost the same as login and password, only for a program, not a person. SelfPrivacy application uses them to manage services in all accounts instead of you. Convenient!

We do not need a token for your domain registrar. But we need a DNS provider token to manage the domain.

If you have chosen deSEC: How to get a token

  1. Log in here.

  2. Go to the Domains page.

  3. Go to the Token management tab.

  4. Click on the round “plus” button in the upper right corner.

  1. “Generate New Token” dialogue must be displayed. Enter any Token name you wish. Advanced settings are not required, so do not touch anything there.

  2. Click on Save.

  3. Make sure you save the token’s “secret value” as it will only be displayed once.

  1. Now you can safely close the dialogue.

If you have chosen Cloudflare: How to get a token

  1. Visit the following link and log in to the account you created earlier.

  2. Click on the profile icon in the upper right corner (for the mobile version of the site: click on the menu button with three horizontal bars in the upper left corner). From the menu that appears, click My Profile.

  1. We have four configuration categories to choose from: Preferences, Authentication, API Tokens and Sessions. Select API Tokens.

  2. The first item we see is the Create Token button. Click it.

  3. Scroll down until you see the Create Custom Token field and the Get Started button on the right side. Press it.

  4. In the Token Name field, give your token a name. You can create your own name and treat it like a pet name :)

  5. Next, we have Permissions. In the first field, choose Zone. In the second field, in the middle, select DNS. In the last field, select Edit.

  6. Click on the blue label at the bottom + Add more (just below the left field that we filled in earlier). Voila, we have new fields. Let’s fill them in the same way as in the previous section, in the first field we choose Zone, in the second one also Zone. And in the third one we press Read. Let’s check what we have:

Your selection must look like this.

  1. Next, look at Zone Resources. Below this heading there is a line with two fields. The first should be Include, and the second should be Specific Zone. Once you select Specific Zone, another field will appear on the right. Here you select our domain.

  2. Scroll to the bottom and click the blue button Continue to Summary.

  3. Check that you have selected everything correctly. You should see a line like this: your.domain - DNS:Edit, Zone:Read.

  4. Press Create Token.

  5. Copy the created token.

If you chose DigitalOcean DNS: How to get a token

The instructions for obtaining a token for DigitalOcean DNS are similar to those used for DigitalOcean hosting servers. However, for managing DNS, you need to create a separate project. Be careful in the project selection menu to avoid confusion. Tokens from different projects should not be the same.

  1. Go to this link and log in to the previously created account.

  2. In the left menu, go to the API page - the last item at the very bottom.

  3. Click Generate New Token in the Personal Access Tokens menu.

  4. Copy the token.

How to get server provider token

If you chose Hetzner

  1. Visit the following link. Authorize the account you created earlier.

  2. Open the project you created. If none exists, create one.

  3. Point the mouse at the side panel. It should open and show you menu items. We are interested in the last one — Security (with a key icon).

  1. Next, at the top of the interface we see something like the following list: SSH Keys, API Tokens, Certificates, Members. We need the API Tokens. Click on it.

  2. On the right side of the interface you will see the Generate API token button. Press it.

  1. In the Description field, give your token a name (this can be any name that you like, it does not change anything in essence).

  2. Under Description, select permissions. Select Read & Write.

  3. Click Generate API Token.

  4. A window with your token will appear, save it.

If you chose DigitalOcean

  1. Go to this link and log in to the previously created account.

  2. In the left menu, go to the API page - the last item at the very bottom.

  3. Click Generate New Token in the Personal Access Tokens menu.

  4. Copy the token.

How to get Backblaze token

  1. Visit the following link and log in to the previously created account.

  2. On the left side of the interface, select App Keys in the B2 Cloud Storage subcategory.

  3. Click on the blue Generate New Master Application Key button.

  4. In the appeared pop-up window confirm the generation.

  5. Copy keyID and applicationKey.

Open the Application

Enter the setup wizard. It’s time to use the tokens we obtained earlier.

The application will prompt you to choose the server location and specifications. We recommend selecting a server closer to your current location. If you have around 5 users, a server with minimal specifications will be sufficient.

The application will prompt you to create a master account that will act as the administrator. Save the account password in a password manager, such as KeePassXC.

At the end, click “Create Server”, the process may take up to 30 minutes.

If something goes wrong, contact the support chats.

🎉 Congratulations! You are now ready to use private services.

After installation, we recommend creating a server recovery key

If something happens to your device, with the recovery key, you can seamlessly connect to the old server.

In the app, go to the “More” menu, then “Recovery Key”. Click “Generate Key”.

You will see a list of words — this will be your key. Save it in a password manager, such as KeePassXC. For security reasons, the application does not allow copying the key.

Remember, possessing this key gives an attacker full access to your server.

Last modified: August 16, 2024