The SelfPrivacy server is created step by step within an hour. Sounds scary, but believe me, you don’t need a PhD to do it. It’s as easy as shopping in an e-shop.
- Finding a passport and card with a balance of $10-15 and $5 per month
- Registration of accounts
- Domain purchasing
- Connecting Domain to DNS Server
- Generating tokens
- Installation
- Connecting to the services
If you delegate this process to someone else, you will lose your privacy. For 100% independence and control we recommend doing everything yourself.
Accounts registration
For stability, SelfPrivacy needs many accounts. We don’t want to trust all the data to one company, so we’d rather distribute parts of the system to different places.
Protecting accounts
Systems are hacked through the weakest link. To prevent accounts from being such a link, passwords must be different
for each account and must be complex. Qwerty123 or VerySecurePassw0rd are very bad passwords.
An example of a good password is a passphrase:
expert repose postwar anytime glimpse freestyle liability effects
or
}Rj;EtG:,M!bc4/|
How can you remember such a complicated password? Absolutely not! Passwords do not need to be remembered, they need to be created and stored in a password manager. However, you’ll need to remember at least one — password from the password manager.
Accounts to create:
- Hetzner or DigitalOcean — virtual hosting servers. Whichever one you choose, your data and SelfPrivacy services will live on it.
- NameCheap, Porkbun or any other registrar, to purchase your personal address on the Internet — the domain that will point to the server.
- deSEC or CloudFlare (not recommended) is a DNS server, where your personal address (domain) works.
- Backblaze is an IaaS, that provides free storage for your encrypted backups.
Registration is trivial, but sometimes account activation can take up to several days or require additional documents. Therefore, use real documents and fill everything out carefully. Providers protect themselves from spam this way. Nothing personal :)
Be sure to enable additional account protection — the second factor (MFA, 2FA). Without this simple step, your data will not be safe.
I know it was hard, but now your data is better protected than 95% of users. You should be proud of yourself! I’m proud of you 🤗
Purchasing a domain
Enabled 2FA? Then let’s get to the most interesting part!
Domain — it’s a piece of the Internet, that you can name like your home pet. The potential for creativity is enormous. Your only limitations are 63 character length + .com .org .icu or other domain zones. Feel free to choose from hundreds of others. You can choose your last name as a domain, like this: jackson.live or carson.health, or it can be something creative, like: unicorn-land.shop
Advice:
- Be sure to look at the annual renewal price, it can be many times the purchase price.
- Normal domain price is $8-10 per year.
- When registering a domain, make sure you enter your real email address, otherwise your registration may be cancelled. And if you can’t renew the domain, the system won’t work as intended.
- A good name comes in handy, both on the phone to dictate, and on your business card.
- Did I mention the 2FA?
Connecting Domain to DNS Server
Once purchased, add your domain to CloudFlare:
Using ruleit.stream as an example, we chose the free service plan and got nameservers: gail.ns.cloudflare.com and mattns.cloudflare.com, which need to be registered with our registrar. For example, with NameCheap:
At the same time, we check that we include auto-renewal and personal data protection — WhoisGuard. After a few minutes or, in the worst case, up to 2 days, the settings will be applied.
Generating tokens
API tokens are almost the same as login and password, only for a program, not a person. SelfPrivacy application uses them to manage services in all accounts instead of you. Convenient!
We do not need a token for your domain registrar. But we need a DNS provider token to manage the domain.
SelfPrivacy supports two providers to choose from: the popular Cloudflare and the privacy-focused deSEC.
If you have chosen deSEC: How to get a token
-
Log in here.
-
Go to the Domains page.
-
Go to the Token management tab.
-
Click on the round “plus” button in the upper right corner.
-
“Generate New Token” dialogue must be displayed. Enter any Token name you wish. Advanced settings are not required, so do not touch anything there.
-
Click on Save.
-
Make sure you save the token’s “secret value” as it will only be displayed once.
- Now you can safely close the dialogue.
If you have chosen Cloudflare: How to get a token
-
Visit the following link and log in to the account you created earlier.
-
Click on the profile icon in the upper right corner (for the mobile version of the site: click on the menu button with three horizontal bars in the upper left corner). From the menu that appears, click My Profile.
-
We have four configuration categories to choose from: Preferences, Authentication, API Tokens and Sessions. Select API Tokens.
-
The first item we see is the Create Token button. Click it.
-
Scroll down until you see the Create Custom Token field and the Get Started button on the right side. Press it.
-
In the Token Name field, give your token a name. You can create your own name and treat it like a pet name :)
-
Next, we have Permissions. In the first field, choose Zone. In the second field, in the middle, select DNS. In the last field, select Edit.
-
Click on the blue label at the bottom + Add more (just below the left field that we filled in earlier). Voila, we have new fields. Let’s fill them in the same way as in the previous section, in the first field we choose Zone, in the second one also Zone. And in the third one we press Read. Let’s check what we have:
Your selection must look like this.
-
Next, look at Zone Resources. Below this heading there is a line with two fields. The first should be Include, and the second should be Specific Zone. Once you select Specific Zone, another field will appear on the right. Here you select our domain.
-
Scroll to the bottom and click the blue button Continue to Summary.
-
Check that you have selected everything correctly. You should see a line like this: your.domain - DNS:Edit, Zone:Read.
-
Press Create Token.
-
Copy the created token.
How to get server provider token
Don't keep your eggs in one basket
If you are planning to use DigitalOcean to handle both server and DNS (which is not recommended), you must use a separate project for DNS records.
DigitalOcean only gives tokens that provide full access to everything in the project. While server provider token stays on your device, the token for DNS management will be stored on your new server. This way, if your server is compromised, the attacker will be able to do more harm than just change your DNS records.
Note: using DigitalOcean as DNS provider is not yet released, but already available on nightly channel.
-
Visit the following link. Authorize the account you created earlier.
-
Open the project you created. If none exists, create one.
-
Point the mouse at the side panel. It should open and show you menu items. We are interested in the last one — Security (with a key icon).
-
Next, at the top of the interface we see something like the following list: SSH Keys, API Tokens, Certificates, Members. We need the API Tokens. Click on it.
-
On the right side of the interface you will see the Generate API token button. If you are using the mobile version of the site — in the lower right corner you will see a red plus button. Press it.
-
In the Description field, give your token a name (this can be any name that you like, it does not change anything in essence).
-
Under Description, select permissions. Select Read & Write.
-
Click Generate API Token.
-
Сopy the token
-
Follow this link and log in to the previously created account.
-
In the left menu look for API — the last item at the bottom.
-
Click Generate New Token in Personal Access Tokens menu.
-
Copy the token.
How to get Backblaze token
-
Visit the following link and log in to the previously created account.
-
On the left side of the interface, select App Keys in the B2 Cloud Storage subcategory.
-
Click on the blue Generate New Master Application Key button.
-
In the appeared pop-up window confirm the generation.
-
Copy keyID and applicationKey.
🎉 Congratulations! Now you are ready to use private services.