What?

Tech independence is not depending on any particular company or software.

The only tools you need are the common open source basics built into any Linux or BSD operating system — free public-domain tools that are not owned by anyone, and can run on any computer.

Learn a few of these basic tools, and you can run your own private server on any computer forever, for the rest of your life. Host your own website and email. Keep your own contacts and calendars synced with your phone. Back up and sync your photos, movies, and music to your own private storage. No more subscriptions needed.

You can ignore all the companies offering “solutions”, even if they are free, because they take away self-reliance. The point is to know how to do it yourself, not to have somebody do it for you. It’s worth a little up-front work, like learning how to drive.

Below are simple step-by-step instructions that work. Instead of drowning you in options, it uses an operating system called OpenBSD and a hosting company called Vultr because I’ve used them for years and I know they are good and trustworthy. But you could do this same setup with any free Linux or BSD operating system, with any hosting company that gives you “root” access to your own private server. You could even do it on an old laptop in your closet.

So if a company turns evil or goes out of business, no problem! You can set up a new server anywhere else in an hour, point your domain name to the new IP address, and it’s done. That’s tech independence — never dependent on any particular provider or software. It’s very empowering. The instructions below will show you how.

Register a domain

1. Go to Porkbun.com.
2. Search for a domain name you like until you find one that’s available.
3. Click the red + (plus) sign, then the [checkout] button.
4. Click the blue [Continue] button in the bottom-right corner.
5. Create a new account, and pay.
6. Congratulations. You’ll use this domain name in many of the steps below.

Create storage

1. Go to Vultr.com.
2. Create an account and give it your credit card.
3. Click “Products” in the left menu, then “Storage - Block/Object” in the horizontal middle of the screen, then the blue (+) on the right, to go to the “Add Block Storage” page.
4. Click “Block Storage (HDD)”, which says “Globally Available”
5. Below that, a list of 28 countries appears. Click the one closest to you.
6. Below that, a slider lets you choose how much storage you need. If not sure, just leave it as $1 for 40 GB.
7. Below that, in a subtle box that says “label” type the word encrypted.
8. Below that, click the “Add Block Storage” button.

Create an SSH key

1. Open a terminal.
   • Windows? Start → Windows PowerShell → Windows PowerShell
   • Mac? Applications → Utilities → Terminal
2. Type ssh-keygen -t ed25519 and hit [enter] or [return].
3. When it says, “Enter file in which to save the key (/Users/yourname/.ssh/id_ed25519):”, hit [enter] or [return].
4. When it says, “Enter passphrase (empty for no passphrase):”, hit [enter] or [return].
5. When it says, “Enter same passphrase again:”, hit [enter] or [return].
6. See the line that starts, “Your public key has been saved in” and ends in “id_ed25519.pub”? That’s the file you need for the next step.
7. In a text editor, open “id_ed25519.pub”.
   • Windows? Type notepad .ssh/id_ed25519.pub
   • Mac? Type open -e .ssh/id_ed25519.pub
8. It should be a single line like this:
   ssh-ed25519 AAAAC3Nz5AAAAIPIXO5icj4LUpqa2baqYQRmCZ1+NV4sBDr you@computer
9. You’ll use this in the next step: “Create your server”.

Create your server

1. In your Vultr.com account:
2. Click “Products” in the left menu, then the blue (+) on the right, to go to the “Deploy New Instance” page.
3. Click “Cloud Compute” (NOT “Optimized Cloud Compute”)
4. Below that, click “Intel Regular Performance”
5. Below that, IMPORTANT: click the same city you chose for your encrypted storage in the previous step.
6. Below that, click “OpenBSD” (the yellow blowfish) then inside its box, click “7.3 x64”
7. Below that, under Server Size, click “25 GB SSD $5/month”
8. A blue pop-up appears underneath, up-selling “For only $1.00 more you can...”. Click “No thanks”.
9. Scroll down to “SSH Keys”, click “Add New”, then under “Name” type mykey.
10. From the previous section, step 3, copy (⌘-C or Ctrl-C) the contents of “id_ed25519.pub” and paste it into this box called “SSH Key”. It should be a single line like this:
    ssh-ed25519 AAAAC3NzaC1XO5iclCcrHbGRPoj4LUpqa2baqYQRmCZ1+NV4sBDr you@computer
11. After pasting it into the box, click [Add SSH Key].
12. Under SSH Keys, click the box with the picture of the key called “mykey” to give it a tick mark in the top-right corner.
13. Scroll up to “Enable Auto Backups”, click the “on” toggle button to turn it OFF.
14. A scary pop-up says “Are you sure....”. Tick the box next to “I understand the risks”, then click the red button “Disable Auto Backups”.
15. Under “Additional Features”, tick the box next to “Enable IPv6”, to disable it.
16. Under “Server Hostname & Label”, type your domain name (the new one you registered at Porkbun). Your domain name should appear in both “server hostname” and “server label”.
17. At the bottom, click the big blue button [“Deploy Now”].
18. Stretch your legs for a minute while waiting for your server status to change from “Installing” to “Running”, then click its name.
19. Copy and save into a separate text file two very important things on screen: the IP Address, and root Password.

Attach storage

1. In your Vultr.com account, click “Products” on the left, then “Storage - Block / Object” up top.
2. Under Block Storage, click the name of your storage, (should be called “encrypted”).
3. Underneath its location, see where it says “Attach to:” and a pull-down menu that says “Instance”? From that menu, choose the only option, which should show OpenBSD 7.3 and your domain name.
4. To “Attach Volume? Are you sure you want to attach this volume?” Click [Attach Volume].
(What you did here was the equivalent of plugging in a USB stick into a computer. You’ll keep this storage separate and encrypted.)

Point your domain here

1. In your Vultr.com account, click “Products” on the left, then click the name of your server in the middle of the page.
2. Click “Settings” in the top menu.
3. Click under “Reverse DNS” in the center-right, where it says something like 123.45.67.89.vultrusercontent.com.
4. Erase everything in that form field, and replace it with your domain name, then click the check-mark.
5. You should see your domain name under “Reverse DNS” now.
6. Copy your IP Address from this page, or from the last step of Create Your Server.
7. Go back to your Porkbun.com account in another browser tab.
8. Under your domain name, click the little word “DNS”.
9. Scroll to the bottom of this page, under “Current Records”, and click the little trash can under “OPTIONS” for each entry.
10. Each will ask, “Are you sure you want to delete this DNS record?”. Click the blue [OK].
11. Scrolling up, under “Here you can configure custom DNS records for your domain.”, set Type to A - Address record.
12. Leave “Host” blank.
13. Under “Answer”, paste your IP address.
14. Click the blue [Add] button, bottom-right.
15. Repeat that step again, with Type as “A - Address record”, but this time, Type * (asterisk) under “Host”, then again under “Answer” paste your IP address.
16. Click the blue [Add] button, bottom-right.
17. Click the little x in the top-right corner of this pop-up window.
18. Now your domain name points to your new server, with or without “www.”.

SSH into root

1. Copy (⌘-C or Ctrl-C) the IP Address from the last step of Create Your Server.
2. Open your terminal from the Create an SSH key section.
3. Whenever I say to type something into the terminal, hit your [return] or [enter] key afterwards.
4. Type into the terminal: ssh root@YOUR-IP-ADDRESS. So for example:
   ssh root@123.45.67.89
5. It should say something like:

   The authenticity of host '123.45.67.78 (123.45.67.89)' can’t be established.
           ED25519 key fingerprint is SHA256:OyiqVsjRX8U2f0UTUY4D0erdl6855YNRXyQk2D.
           This key is not known by any other names
           Are you sure you want to continue connecting (yes/no/[fingerprint])?

6. Type yes
7. It should say something like:

   Warning: Permanently added '123.45.67.89' (ED25519) to the list of known hosts.
           OpenBSD 7.3 (GENERIC.MP) #1125: Sat Mar 25 10:36:29 MDT 2023
           Welcome to OpenBSD: The proactively secure Unix-like operating system.

8. Congratulations! You’re inside a remote computer!
9. Type syspatch to apply security updates.
10. Type reboot. It should say something like:

    Connection to 123.45.67.89 closed by remote host.
            Connection to 123.45.67.89 closed.

11. Wait a minute for it to reboot, then repeat step 4 above. Type into the terminal:
    ssh root@YOUR-IP-ADDRESS
12. Once again it should say, “Welcome to OpenBSD”, and more. Stay logged in, and go to the next section.

Customize the instructions!

Enter your domain name and the username that you create, below, and this will customize all following instructions for you.

Now when you see this button: 📋 click it to copy that line so you can paste it into your terminal, without error.

Create your username

1. You should be in your terminal, logged in to your server as root, from the previous section.
2. Type adduser
3. “Enter your default shell: csh ksh nologin sh [ksh]:”, hit [return] or [enter]
4. “Default login class: authpf bgpd … vmd xenodm [default]”, hit [return] or [enter]
5. “Enter your default HOME partition: [/home]:”, hit [return] or [enter]
6. “Copy dotfiles from: /etc/skel no [/etc/skel]:”, hit [return] or [enter]
7. “Send welcome message?: /path/file default no [no]”, hit [return] or [enter]
8. “Prompt for passwords by default (y/n) [y]:”, hit [return] or [enter]
9. “Default encryption method for passwords: auto blowfish [auto]:”, hit [return] or [enter]
10. “Enter username []:”, create your one-word lower-case name, usually your first/given name, the one that will be the part before the @ in your new email address (yourusername@yourdomain.name). You are the only user on this system, so basically every name is free.
11. “Enter full name []:”, type your full name.
12. “Enter shell: csh ksh nologin sh [ksh]:”, hit [return] or [enter]
13. “Uid [1000]:”, hit [return] or [enter]
14. “Login group yourusername [yourusername]:”, hit [return] or [enter]
15. “Invite yourusername into other groups: guest no [no]:”, Type wheel
16. “Login class authpf ... xenodm [default]:”, hit [return] or [enter]
17. “Enter password:”, type a new password only you will know. It won’t appear on the screen as you type.
18. “Enter password again:”, type that password again to verify. It still won’t appear on the screen, so type carefully.
19. It will show you your info, then when it says “OK? (y/n) [y]:”, hit [return] or [enter]
20. “Add another user? (y/n) [y]:”, Type n
21. Type 📋echo 'permit nopass yourusername' >> /etc/doas.conf
22. Open a new terminal window on your computer, so that this first window stays logged in as root.
23. In the new terminal window, type: 📋ssh yourusername@yourdomain.name
24. It should say something like

    The authenticity of host 'yourdomain.name (123.45.67.89)' can’t be established.
            ED25519 key fingerprint is SHA256:qVsjRX8U2f0UTUY4D0erdl6855YNRXyQk2Dgv4.
            This host key is known by the following other names/addresses:
                ~/.ssh/known_hosts:1: 123.45.67.89
            Are you sure you want to continue connecting (yes/no/[fingerprint])

25. Type yes
26. After a “Warning: Permanently added…”, and “yourusername@yourdomain.name’s password: ”, type your new password.
27. If it says “Welcome to OpenBSD” (among other things), congratulations, you did all the above steps correctly! If not, go back to the first terminal window that is still logged in as root, and try to repeat those steps. But assuming it worked, continue:
28. Type exit to log out (it should say “Connection to yourdomain.name closed.”)
29. Copy your SSH public key to the server:
    • Windows? Type 📋Get-Content $env:USERPROFILE\.ssh\id_ed25519.pub | ssh yourusername@yourdomain.name "cat >> .ssh/authorized_keys"
    • Mac? Type 📋ssh-copy-id yourusername@yourdomain.name
30. Type your new password when it asks.
31. Type 📋ssh yourusername@yourdomain.name
32. If it says “Welcome to OpenBSD” (among other things), without asking for a password, congratulations! This is how you will log in from now on, and it’s using your key instead of your password.

Another user?

Want someone else to also have access to this server, or receive their own email at theirname@yourdomain.name?

1. Ask that person to create an SSH key on their own computer, as described here.
2. Change “Customize the instructions” to their new username you are about to create.
3. Repeat the “Create your username” section for their new username, but…
4. … notice it now skips step 3-9.
5. … and that person should do steps 22 to 32 on their own computer, uploading their own SSH key.

Do this for as many users as you would like. There is practically no limit. Do it before you lock things tightly in the next section.

Secure your login

This is an optional but highly recommended step to secure your server so nobody can log in without your uniquely-generated SSH key.

1. As described in the last few steps of the previous section, log in to your server. (ssh yourusername@yourdomain.name)
2. Type 📋doas su
3. Type 📋sed -i 's/RootLogin yes/RootLogin no/g' /etc/ssh/sshd_config
4. Type 📋echo 'PasswordAuthentication no' >> /etc/ssh/sshd_config
5. Type 📋rcctl restart sshd
6. Type exit and exit again until it says “Connection to yourdomain.name closed.”)
7. Type 📋ssh yourusername@yourdomain.name
8. If it says “Welcome to OpenBSD”, congratulations! Your server is now extremely secure. Go back up your SSH keys — the two files you created in “Create an SSH key” named “id_ed25519” and “id_ed25519.pub”. You can even copy these two files to another computer to be able to log in from there.

Format storage

1. Log in to your server. (ssh yourusername@yourdomain.name)
2. Type 📋doas su
3. Type 📋disklabel -E sd1
4. It will say “Label editor (enter '?' for help at any prompt)”
5. Type a a (“a”, then space, then “a”)
6. “offset: [0]”, hit [return] or [enter]
7. “size: [83886080]”, hit [return] or [enter]
8. “FS type: [4.2BSD]”, Type RAID
9. “sd1*>”, Type w
10. “sd1>” again, Type q
11. It will say “No label changes.”
12. Type 📋bioctl -c C -l sd1a softraid0
13. “New passphrase:”, type a new password only you will know. It won’t appear on the screen.
14. “Re-type passphrase:”, type that password again to verify.
15. It will say “softraid0: CRYPTO volume attached as sd2”
16. Type 📋disklabel -E sd2
17. It will say “Label editor (enter '?' for help at any prompt)”
18. Type a a (“a”, then space, then “a”)
19. “offset: [0]”, hit [return] or [enter]
20. “size: [83885552]”, hit [return] or [enter]
21. “FS type: [4.2BSD]”, hit [return] or [enter]
22. “sd2*>”, Type w
23. “sd2>” again, Type q
24. It will say “No label changes.”
25. Type 📋newfs sd2a
26. It will say something like “/dev/rsd2a: 40959.7MB in 83885536 sectors of 512 bytes” then many lines of numbers. Congratulations you now have encrypted storage. Let’s make it easy to mount and unmount.
27. Type 📋pkg_add rsync--iconv
28. Type 📋exit
29. Type 📋mkdir bin
30. Type 📋cd bin
31. Type or copy-paste this next line, all on one line: 📋
    echo '#!/bin/sh\ndoas bioctl -c C -l sd1a softraid0\ndoas mount /dev/sd2a /mnt\nls -l /mnt' > m
32. Type or copy-paste this next line, all on one line: 📋
    echo '#!/bin/sh\ndoas umount /mnt\ndoas bioctl -d sd2\necho "unmounted"' > m-x
33. Type 📋chmod 700 m*
34. Type m-x and it should say “unmounted”
35. Type m
36. When it says “Passphrase:”, give it the storage password you created in step 13.
37. Type 📋doas chown $USER:wheel /mnt
38. Type 📋doas chmod 770 /mnt
39. Now detach it by typing “m-x”. Attach it again by typing “m”. Practice a few times. These are your shortcut commands to attach (m) and detach (m-x) your private encrypted storage. Like plugging in and removing a USB stick.

Use your storage

1. Log in to your server, if you are not already. (ssh yourusername@yourdomain.name)
2. Attach your private encrypted storage by typing “m”
3. When it says “Passphrase:”, give it the password you created in the previous section.
4. If it says “softraid0: chunk sd1a already in use, mount_ffs: /dev/sd2a on /mnt: Device busy”, that’s fine. It just means it was already attached.
5. If it says “mount_ffs: /dev/sd2a on /mnt: filesystem must be mounted read-only; you may need to run fsck”, just type doas fsck_ffs -y /dev/sd2a to fix it. It means at some point you unmounted the encrypted /mnt partition while one of your terminal user sessions was still in it. It's the equivalent of closing a shop at night while a customer is still inside. When it says “you may need to run fsck” it’s like saying “you need to check the inventory before we open”, to make sure nothing is missing.
6. Type exit
7. On an Apple Mac? Type rsync -avz Documents yourusername@yourdomain.name:/mnt/ and you will see it uploading your Documents folder to your private encrypted storage. Use this same format to upload any other folders, replacing “Documents” in the command. If you are happy synchonizing on the command line like this, you can skip over the next FreeFileSync section, or try it to see if you prefer it.

FreeFileSync

Everyone using Windows, and Mac people that prefer a point-and-click program, should use FreeFileSync. Here’s how:

1. Download FreeFileSync and please give an optional donation there if you can afford to. Donating also unlocks more features. Thanks to Jon Lis for the recommendation.
2. Install and open FreeFileSync.
3. Top-center: click the grey [Browse] button and find the folder with the stuff you want to upload.
4. Top-far-right: click the white cloud icon then SFTP at the top.
5. Server name or IP address: yourdomain.name
6. Left side: click (*) Key File
7. Username: yourusername
8. Browse to find your private key, called id_ed25519 from the “Create an SSH key” section. (Not the file that ends in “.pub”, but the one next to it.) NOTE: Because the /Users/yourusername/.ssh directory is “hidden” by Windows and Mac by default, I find it easier to just type the path directly, like this:
   • The username, for this next line, should be your username on your home computer, not your remote server.
   • Windows? Type 📋C:\Users\yourusername\.ssh\id_ed25519
   • Mac? Type 📋/Users/yourusername/.ssh/id_ed25519
9. Directory on server: /mnt
10. Click OK to go back to the main screen.
11. Top-right: click the green gear wheel.
12. Left button: click “MIRROR →”
13. Click OK to go back to the main screen.
14. Top-center: click “COMPARE”, and make sure your files are there.
15. Top-right: click “SYNCHRONIZE Mirror →” then [Start]

Verify and unmount

1. When it’s done uploading, log in to your server again, from your terminal.
2. Type find /mnt
3. You should see a long list of the files you uploaded.
4. Type m-x to detach your encrypted storage.
5. Type find /mnt again, and now you should see nothing there! Congratulations! You now see how this will work in the future:
   1. Log in and type “m” to attach your encrypted storage.
   2. Upload your files with rsync or FreeFileSync.
   3. Log in and type “m-x” to detach the storage, for security.

More storage?

If you need hundreds of gigabytes, or even terabytes of storage, I recommend Hetzner’s “Storage Box”. It’s the best storage value I’ve found. Also consider Backblaze Personal Backup.

I personally use Vultr’s storage (as described above) for sensitive information I definitely want completely encrypted. Then I use Hetzner’s Storage Box for all my photos, videos, music, and other big files that don’t absolutely need to be encrypted.

Phones

Sometimes people email me, after setting up everything here, to ask, “So how do I sync all my photos and videos from my phone to this storage?” Well, bad news.

Because phones are quite locked-down by Google and Apple, they’re not (yet) general-purpose computers. So copy everything to your computer, back it up from your computer, then erase it from your phone. Until your stuff is off your phone it’s not fully in your control.

If this changes, and you know of a way to sync all of your photos and videos directly from your phone to a remote SFTP server, please let me know and I will update these instructions.

Web server

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋cd /etc
4. Type 📋ftp https://sive.rs/file/httpd.conf
5. Type 📋ftp https://sive.rs/file/relayd.conf
6. Type 📋ftp https://sive.rs/file/acme-client.conf
7. Type 📋sed -i s/example.com/yourdomain.name/g httpd.conf relayd.conf acme-client.conf
8. Type 📋rcctl enable httpd
9. Type 📋rcctl start httpd
10. It should say “httpd(ok)”.
11. Type 📋acme-client -v yourdomain.name
12. Watch it work for 10-20 seconds until it ends with the word “created”.
13. Type 📋rcctl enable relayd
14. Type 📋rcctl start relayd
15. It should say “relayd(ok)”.
16. Type 📋echo '<h1>It worked!</h1>' > /var/www/htdocs/index.html
17. Type 📋rm -r /var/www/htdocs/bgplg
18. Type 📋mkdir /var/www/htdocs/pub
19. Type 📋chown -R yourusername:yourusername /var/www/htdocs
20. In your browser, go to https://yourdomain.name/ and you should see a big “It worked!”. Congratulations! You now have your own secure web server. Now we need to make sure it stays secure by having it automatically renew its secure certificate.
21. Back in your terminal, type: 📋crontab -e
22. You will see a page full of text, starting with SHELL=/bin/sh. This is your first time editing a file. Don’t be scared. Here we go:
23. Type 15G (that’s a capital G) without hitting [return] or [enter] and you’ll see your cursor now at the start of the line that ends in “weekly”.
24. Type yyp without hitting [return] or [enter] to copy+paste that line.
25. Type f/ without hitting [return] or [enter] to move your cursor to the first /.
26. Type a capital C without hitting [return] or [enter] and you’ll see the last character became a $.
27. Type 📋acme-client yourdomain.name && rcctl reload relayd
28. Hit your [esc] key in the very top-left corner of your keyboard. Nothing will change on the screen, yet.
29. Type :wq (the “:” at the beginning is important) then [enter] or [return].
30. That should bring you back to your command line, where it says, “crontab: installing new crontab”.
31. Type crontab -l (that’s a lowercase “L”), and you should see the file you edited, with the line you added. If so, congratulations! You just used the legendary vi editor!
32. Type exit to get out of “root” mode and back into your usual username.

Simple website

1. On your home computer, in your main home directory, make a directory/folder called “htdocs”
2. Download this file called “template.html” and save it in your “htdocs” directory.
3. Download this file called “style.css” and also save it in your “htdocs” directory.
4. Make a copy of the “template.html” file, and name the copy “index.html”. This will be your home page.
5. Edit the index.html file in a text editor (NotePad or TextEdit) and change my default text to whatever you want.
6. When you need to add a new page, just copy the template again, call it “about.html” or whatever, and make a link to it from the home page. The header of each page will link back to index.html : your home page.
7. If you want to change the look of your site, just edit the style.css file. Search the web for “CSS tutorial” if needed.
8. To upload it to your public server, do one of the next two steps:
9. Apple Mac? Open a new terminal window on your computer, type
   rsync -avz htdocs yourusername@yourdomain.name:/var/www/
10. Windows? FreeFileSync again, but now change the “Directory on server” to /var/www/ (you can find it by clicking [browse] or typing it directly) then upload this htdocs directory there.
11. Go to https://yourdomain.name in your web browser, refresh the page, and you should see your updated website.
12. Any trouble, just know that the goal is to get that index.html file into this location on your server: /var/www/htdocs/index.html because that’s where the web server is expecting it to be. That’s where we put the original “It worked!” file, so your new index.html file should replace that one.
13. If you want short URLs, without the .html, you can (for everything except index.html) because I set the default type to be HTML. Just remove the “.html” from your HTML filenames, update your links, and voilà!

File sharing in /pub/

Your website is configured to list all files in the /pub/ directory of your website. So basically anything in /var/www/htdocs/pub/ is public. Let me show you by example, by putting some files in it.

1. Log in to your server, if you are not already.
2. Type 📋cd /var/www/htdocs
3. Type 📋mkdir -p pub
4. Type 📋cd pub
5. Type 📋ftp https://sive.rs/file/hello.txt
6. Type 📋ftp https://sive.rs/file/hello.pdf
7. Type 📋ftp https://sive.rs/file/derek.jpg
8. Type 📋ftp https://sive.rs/file/guitar.mp3
9. Type 📋ftp https://sive.rs/file/ymap.mp4
10. Type exit when done.
11. Go to https://yourdomain.name/pub/ in your web browser, and you should see the files. Click on each to test.
12. Right-click or [Ctrl]-click on any filename in the list, then from the pop-up menu choose “Copy link address” or “Copy Link”.
13. Go paste that URL (https://yourdomain.name/pub/guitar.mp3) into an email or text to your phone. Then click that link from your phone. See?

If the files you want to share are already on your computer, then just make a pub/ directory inside htdocs/ (so, htdocs/pub/), put your files in there, then use FreeFileSync or rsync to upload them as you did in the previous section called “Simple website”. Consider them part of your website.

Or if you have a URL from somewhere else online that you want to download to your server, just do it as we did in the numbered steps above. Then use FreeFileSync or rsync to download from your server to your computer first, before your next upload sync.

Contacts and Calendar

Your phone currently keeps its contacts and calendars with Google or Apple. Host them yourself using Radicale. Here’s how.

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋pkg_add radicale
4. Type 📋sed -i 's/#type = none/type = htpasswd/g' /etc/radicale/config
5. Type 📋htpasswd /etc/radicale/users yourusername
6. “Password:”, make a new password that’s easy to type on your phone.
7. “Retype Password:”, type that password again to verify.
8. Type 📋chown _radicale /etc/radicale/users
9. Type 📋rcctl enable radicale
10. Type 📋rcctl start radicale
11. Type exit
12. In your browser, go to https://dav.yourdomain.name/
13. You should see a Login page. Give it the Username and Password you created in this section. It should work, and bring you to a page called “Collections”.
14. Click “Create new addressbook or calendar”
15. Title: yourdomain.name, leave Description empty, and change Type to addressbook. Then click [Create].
16. You should now see it listed with a long URL. Again, click “Create new addressbook or calendar”
17. Title: yourdomain.name, leave Description empty, and change Type to just calendar. Then click [Create].
18. You should now see both listed with a long URL. Let’s connect your phone.

Android phone

You need an app called “DAVx⁵”, so install it first. Then…

1. Open the DAVx⁵ app
2. Click the orange (+) in the bottom-right
3. Click (·) “Login with URL and user name”
4. Base URL: https://dav.yourdomain.name/
5. User name: yourusername
6. Password: the “easy to type on your phone” password you made in step 7
7. Click “LOGIN” in the bottom-right corner.
8. It should work and bring you to the “Create account” page, where “Account name” will be yourusername. Leave everything as-is and click “CREATE ACCOUNT” in the bottom-right corner.
9. It brings you to the “CARDDAV” header. Tick the toggle to turn on next to your domain name.
10. Click the ♻ arrows in the bottom-right corner to synchronize your contacts.
11. Click the “CALDAV” header up top. Tick the toggle to turn on next to your domain name.
12. Click the ♻ arrows in the bottom-right corner to synchronize your calendar.
13. Go to your Contacts app, and in the bottom-right corner, click “Fix & manage”.
14. Click “Settings”
15. Near the bottom, click “Default account for new contacts”, and change it to the DAVx⁵ Address book with your domain name.
16. Click “< Settings” in the top-left corner.
17. In the top-right corner, click the round icon there. (Might be your face or a letter.) Then change it to the DAVx⁵ Address book with your domain name. Then click X in the top-left corner.
18. Click “Contacts” in the bottom-left corner. It should say “No contacts in this account”.
19. Click + in the bottom-right corner to Create contact. Top of the next page should say “Save to” then your domain name.
20. Add a New Contact with First name: Xxxxx Last name: Xxxxx. Then click “Save” in the top-right corner.
21. Go to your Calendar app, and in the top-right corner, click the round icon there. (Might be your face or a letter.) Then change it to the one with yourusername. After changing it, click the X in the top-left corner.
22. To add a new Event, Click [+] in the bottom-right corner, and choose “Event” from the popup menu.
23. There might be a warning, “Switch to a Google Account to take advantage blah blah…”. Click “dismiss”.
24. Title this event Zzzzzz, and notice it should be saving to the calendar with your domain name and username. Click (Save) in the top-right corner.
25. Now skip over to the next step that says “Test that it worked”.

Apple iPhone

1. Settings → Contacts → Accounts → Add Account → Other → (under “CONTACTS”:) Add CardDAV Account
2. Server: dav.yourdomain.name
3. User Name: yourusername
4. Password: the “easy to type on your phone” password you made in step 7
5. Click “next” in the top right corner, and it should bring you to your “Accounts” page, where you see it listed, saying “Contacts” underneath.
6. Click Add Account → Other → (under “CALENDARS”:) Add CalDAV Account
7. Server: dav.yourdomain.name
8. User Name: yourusername
9. Password: the “easy to type on your phone” password you made in step 7
10. Click “next” in the top right corner, and it should bring you to a “CalDAV” page, showing Calendars and Reminders. Un-tick Reminders.
11. Click “save” in the top right corner, and it should bring you to your “Accounts” page, where you see it listed, saying “Calendars” underneath.
12. Click “< Contacts” in the top-left corner, to go back to settings for your Contacts app.
13. At the bottom change Default Account to the one with yourdomain.name.
14. Click “< Contacts” then “< Settings”, both in the top-left corner, then scroll down to Calendar settings and click it.
15. In Calendar settings, 2nd from the bottom should say “Default Calendar”. Tap to change it to the one with yourdomain.name.
16. Go to your Contacts app and click the + in the top-right corner.
17. Add a New Contact with First name: Xxxxx Last name: Xxxxx. Then click “Done” in the top-right corner.
18. Go to your Calendar app and click the + in the top-right corner.
19. Add a New Event with Title: Zzzzz. Then click “Add” in the top-right corner.

Test that it worked

1. Log in to your server, if you are not already.
2. Type 📋doas grep -R xxx /var/db/radicale
3. You should see a line with “Xxxxx Xxxxx” at the end.
4. Type 📋doas grep -R zzz /var/db/radicale
5. You should see a line with “Zzzzz” at the end.
6. Congratulations! This shows that your phone is successfully saving contacts and calendars to your server!

If you didn’t see them, check your account sync settings on your phone to make sure it’s syncing, or manually do a sync for now.

You can delete the “Xxxx” person and “Zzzz” event now. It was only for that purpose of finding it on your server.

How to copy over all your contacts and calendars? Just use whatever device you’re using. iPhone, Android, Mac, Windows, Outlook, Thunderbird, whatever it is: just use that. You don’t need to load things into Radicale. Just load them into your existing Contacts and Calendars app, and Radicale is the invisible back-end you’ll almost never need to touch.

OK, last step, let’s make sure your contacts and calendars are backed-up nightly, so if you accidently delete something, you can find it in the backup location on your server.

Backups

1. Log in to your server, if you are not already.
2. Type cd ~/bin
3. Type or copy-paste, all on one line: 📋
   echo '#!/bin/sh\ndoas cp -r /var/db/radicale $HOME/\ndoas chown -R $USER $HOME' > radbak
4. Type 📋chmod 700 radbak
5. Type 📋crontab -e
6. On the blank page, type i with no [enter] or [return] after
7. In this next step, make sure you leave a space after every 3 and * (asterisk)
8. Type 📋3 3 * * * /home/yourusername/bin/radbak
9. Hit your [esc] key in the very top-left corner of your keyboard. Nothing will change on the screen, yet.
10. Type :wq (the “:” at the beginning is important) then [enter] or [return].
11. That should bring you back to your command line, where it says, “crontab: creating new crontab for yourusername” and “installing new crontab”.

Now it will automatically backup your contacts and calendars to your home directory every night at 3:03am.

If you want to get into the habit of moving them over to your encrypted storage when you “m” to mount it, that’s up to you. ☺

Email basics

1. Go to your Vultr account and ask them to unblock port 25 so you can run a personal mail server.
2. Go to your Porkbun.com account.
3. Under your domain name, click the little word “DNS”.
4. Change “Type:” to “MX - Mail exchange record”
5. Leave “Host:” blank.
6. In “Answer:” type your domain name.
7. Leave “TTL:” as 600.
8. In “Priority:” type 0   (that’s the number zero)
9. Click the blue [Add] button, bottom-right.
10. Click the little x in the top-right corner of this pop-up window.
11. Go do the “Secure web server” section if you haven’t already.
12. Log in to your server, if you are not already.
13. Type 📋cd ; mkdir -p Maildir/{cur,new,tmp} ; chmod -R 700 Maildir
14. Type 📋ftp https://sive.rs/file/.muttrc
15. Type 📋ftp https://sive.rs/file/.mailcap
16. Type 📋sed -i s/USER/$USER/g .muttrc
17. (If you created more than one user, in the “Another user?” section, repeat these last four steps for each user.)
18. Type 📋doas su
19. Type 📋pkg_add links
20. Type 📋pkg_add mutt--sasl
21. Type 📋cd /etc/mail
22. Type 📋ftp https://sive.rs/file/smtpd.conf
23. Type 📋sed -i s/example.com/yourdomain.name/g smtpd.conf
24. Type 📋rcctl restart smtpd
25. It should say “smtpd(ok)”. Type exit
26. OK. You should have a working mail server installed now. Go send an email to yourusername@yourdomain.name from your existing email accounts (Gmail, Hotmail, Outlook, Yahoo, etc.) If you only have one email account, send two separate emails to help you test the next part.
27. Back in your server, type mutt
28. You should see the subject headers from the emails you sent, with the first email highlighted. Type j and k a few times to go down and up the list of emails.
29. To read an email, hit [enter] or [return] when it is highlighted.
30. To go back to the list, type i (for “index”)
31. To reply, hit r then:
    • It shows “To:” so you can edit or add recipients. Hit [enter] or [return] to leave it.
    • It shows “Subject:” so you can edit the subject. Hit [enter] or [return] to leave it.
    • It asks “Include message in reply? ([yes]/no/?):”. Hit [enter] or [return] for the usual norm of echoing someone’s email back at them below your reply. Or n for not.
    • Now you are inside the vi text editor which is not self-explanatory, so I’ll walk you through a simple reply:
    • Hit i (no [return] or [enter]) to go into “insert mode” and type your message. You’ll notice it’s on the same line as some other text, so you might want to start by hitting [return] or [enter] a few times, then up-arrow to go back to the first line again.
    • When done typing your message, hit your [esc] key in the very top-left corner of your keyboard. Nothing will change on the screen, yet.
    • Type :wq (the “:” at the beginning is important) then [enter] or [return].
    • Then you’ll see the “Compose Menu” which I think of as the “last chance before sending” screen. Hit y to send it.
32. To send a new email, hit m then repeat those steps like you did for a reply, except now the “To:” and “Subject:” are blank and waiting for you to create. (For “To:”, type the email address of the person you’re emailing.)
33. To quit, hit q

Mutt is a great program for reading and sending email on the command line. It’s been my email client for 20 years. Read its manual here if you want to go deeper. It does everything.

The vi text editor is a useful tool to edit text on a server. It takes a few minutes to learn, but it’s worth learning because it’s installed by default on every Linux/BSD server.

Email tips

If you are using a new domain name, then it’s likely that your outgoing emails will be marked as spam for a while. This is because spammers would register a new domain, send out a ton of spam from it, then once it’s widely reported as spam, shut it down and register a new one. So the big email providers now prejudice against new domains. My advice is to set up this account now, then slowly ease into using it.

Ideally keep it as a private email account that you only give to those few people who you really want to hear from. Then your old gmail/yahoo/outlook/etc address can be just low-priority junk. And your new private email account won’t need spam protection.

Email from anywhere

To do email from your phone, computer, or anywhere else, you need an IMAP server, so we’ll set up one called Dovecot.

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋pkg_add dovecot
4. Type 📋cd /etc/dovecot
5. Type 📋rm -rf *
6. Type 📋ftp https://sive.rs/file/dovecot.conf
7. Type 📋sed -i s/example.com/yourdomain.name/g dovecot.conf
8. Type 📋rcctl enable dovecot
9. Type 📋rcctl start dovecot
10. It should say “dovecot(ok)”
11. Type exit

IMAP account settings:

Now on any device, you can add a new IMAP Mail account, with these settings:

• Account type: IMAP
• Email address: yourusername@yourdomain.name
• Username: yourusername
• Password: your password from the “Create your username” section, step 17.
• Incoming mail server: yourdomain.name
• Outgoing mail server: yourdomain.name
• Connection security: SSL
• Authentication type: Basic authentication

Email verification

To show you are not a spammer, update your DNS settings and sign your outgoing emails. Thank you to Harel Williams for these instructions.

DNS: SPF

1. Go to your porkbun.com account.
2. Under your domain name, click the little word “DNS”.
3. Change “Type:” to “TXT - Text record”.
4. Leave “Host:” blank.
5. In “Answer:” type v=spf1 mx -all
6. Click the blue [Add] button, bottom-right.
7. Click the little x in the top-right corner of this pop-up window.
8. Test that the SPF record is configured properly at mxtoolbox.com

DNS: DMARC

1. Go to your porkbun.com account.
2. Under your domain name, click the little word “DNS”.
3. Change “Type:” to “TXT - Text record”.
4. In “Host:” type _dmarc
5. In “Answer:” type v=DMARC1; p=quarantine; rua=mailto:email@example.com
   replacing email@example.com with your old email address where you get mostly spam, because you will often receive reports here.
6. Click the blue [Add] button, bottom-right.
7. Click the little x in the top-right corner of this pop-up window.
8. Test that DMARC is configured properly at mxtoolbox.com. Note that the selector is mail as the tool asks you for it.

DKIM

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋pkg_add opensmtpd-filter-dkimsign
4. Type 📋cd /etc/mail
5. Type 📋openssl genrsa -out /etc/mail/dkim/yourdomain.name.key 2048
6. Type 📋openssl rsa -in /etc/mail/dkim/yourdomain.name.key -pubout -out /etc/mail/dkim/yourdomain.name.pub
7. Type 📋chown -R _smtpd dkim
8. Type 📋chmod -R 700 dkim
9. Type 📋vi /etc/mail/smtpd.conf
10. Type 📋/listen
11. Hit the letter O (Capital letter “O” as in Ohio) to add the next line:
12. Type 📋filter "dkimsign" proc-exec "filter-dkimsign -d yourdomain.name -s mail -k /etc/mail/dkim/yourdomain.name.key -c relaxed/relaxed"
13. Hit your [esc] key in the very top-left corner of your keyboard. Nothing will change on the screen.
14. Type 📋/listen
15. Type A to add to the end of the line, then space bar to add a space before this next step:
16. Type 📋filter "dkimsign"
17. Hit your [esc] key. Now we will do those last three steps two more times:
18. Type 📋/listen
19. Type A to add to the end of the line, then space bar to add a space before this next step:
20. Type 📋filter "dkimsign"
21. Hit your [esc] key. Now we will do those last three steps one more time:
22. Type 📋/listen
23. Type A to add to the end of the line, then space bar to add a space before this next step:
24. Type 📋filter "dkimsign"
25. Hit your [esc] key. Now every line that starts with listen should end with filter "dkimsign"
26. Type :wq (the “:” at the beginning is important) then [enter] or [return].
27. Type 📋rcctl restart smtpd
28. Type 📋sed '1d;$d' /etc/mail/dkim/yourdomain.name.pub | tr -d "\n" | echo "v=DKIM1;k=rsa;p=$(cat)" > /var/www/htdocs/pub/dkim.txt
29. In your browser, go to https://yourdomain.name/pub/dkim.txt and you should see a few lines of random characters. This is only a convenience to make it easy for you to copy and paste into the step below. You don’t need this “dkim.txt” file after that.
30. In a new browser tab, go to your porkbun.com account.
31. Under your domain name, click the little word “DNS”.
32. Change “Type:” to “TXT - Text record”.
33. In “Host:” type mail._domainkey
34. Go back to https://yourdomain.name/pub/dkim.txt and copy (⌘-C or Ctrl-C) those few lines of random characters. Every letter counts!
35. Go back to Porkbun. Put your cursor in “Answer:” and paste (⌘-V or Ctrl-V) those few lines of random characters.
36. Click the blue [Add] button, bottom-right.
37. Click the little x in the top-right corner of this pop-up window.
38. Test that DKIM is configured properly in DNS at mxtoolbox.com. Note that the selector is mail .
39. Test that DKIM signing is configured properly on your server at dkimvalidator.com.

More indie tips

1. Use Firefox.
2. Install uBlock Origin in Firefox and Chrome.
3. In Firefox settings, under “Privacy and Security”, choose “[X] Delete cookies and site data when Firefox is closed”, then close Firefox often to erase all your cookies and logins. Browse the web anonymously, not logged-in.
4. Replace Google Authenticator with Aegis on Android or Raivo on iPhone.
5. If you use Windows, replace it with Ubuntu Linux. (Use both at first, then slowly transition.)
6. If you don’t want to run your own email server, use Mailbox.org or Fastmail but only by using your own domain name. Be yourusername@yourdomain.name from now on. Don’t depend on anyone else’s domain for your email or you’ll be stuck with them.

Upkeep

You honestly don’t have to do anything to maintain your server. It will just work as-is for decades! But if you like to keep it up-to-date, it only takes a minute, so run these next steps any time.

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋syspatch
4. Type 📋fw_update
5. Type 📋pkg_add -u
6. Type 📋sysupgrade
7. Type exit; exit to log out.

If that last “sysupgrade” step did not give an “Error retrieving … 404 Not Found” error, that means your OpenBSD operating system is upgrading itself. They release an upgrade every 6 months. In that case, go to this OpenBSD page and follow the link at the top that says “Upgrading to (7.4, etc)” to see if there’s anything else you should know.

If the “sysupgrade” step updated your operating system and your server rebooted, then there is just one more step:

1. Log in to your server, if you are not already.
2. Type 📋doas su
3. Type 📋sysmerge
4. Follow any instructions. Don’t worry about messing up because you can always start over, as described below.
5. Re-do the syspatch ; fw_update ; pkg_add -u steps, above.
6. Type exit; exit to log out.

Trouble? Start over

I’ve tested the steps above very carefully and repeatedly. They work. So if you hit a major problem, something not happening like it says it should, please do this:

1. Type “cd ; m-x ; exit” in any terminals you still have open, until they are all closed.
2. Go to your Vultr account.
3. See your server instance? See to the far right, a subtle ···? Click that.
4. From its pop-up menu, click the last option: “Server Destroy”.
5. Tick the box next to “[X] Yes, destroy this server.”
6. Click the big red [Destroy Server] button.
7. This will not destroy your encrypted storage. That’s another reason we kept it separate from the start. So if you already uploaded a bunch of your files and want to save them, then when re-doing the instructions, skip the “Format storage” section from step 3 through step 26 where it says, “Congratulations you now have encrypted storage.” and start at step 27.
8. On your own computer, in the terminal, type: rm .ssh/known_hosts
9. Go back to the section called “Create your server” and try again.

You will see it goes much faster the second time, so you have only lost a few minutes. (I have started over at least twenty times to make this tutorial, to make sure all these steps work from scratch.)

Questions? Additions?

To learn more about all these steps above, just log in to your server and type: help
It will teach you the basics. Then for each command or file you want to know more about, type man followed by the command or filename. So for example, log in and type…

• man adduser
• man ssh
• man doas
• man rcctl
• man pkg_add
• man ftp
• man httpd.conf

Hit your [space] bar to scroll the page, then q to quit.

It’s one of the most wonderful things about OpenBSD: everything you need to know is in those man pages! No need for YouTube, Google, ChatGPT, or any other advertising-driven sources of information.

I will constantly improve this page, so get on my private email list for updates.

Until then, ask any questions. If something went wrong, please give me a very specific description of exactly what went wrong at what step, what it was supposed to do, and what exactly it actually did. Click here to email me.

Requests for what to add? Again, just email me.