Docs
Self-host Etoki
Etoki is designed to run on your own infrastructure. This guide covers what you deploy and the two supported paths to run it.
What you're deploying
A full Etoki deployment is a small set of independent services. You can run all of them on one box or spread them across hosts:
- Router — holds message queues and performs 2-hop onion forwarding. This is the core.
- File relay — chunked, padded file transfer.
- Push relay — content-free encrypted push fan-out.
- Directory — optional
@usernamelookup that maps a name to a contact address (never message content). - Gateway — optional TLS-camouflage endpoint that makes traffic look like ordinary HTTPS on port 443.
- etokid — the headless daemon that powers bots.
You
sender
encrypted
Entry
sees your IP, not the peer
encrypted
Destination
sees the peer, not you
encrypted
Peer
recipient
No single router sees both endpoints. Content is end-to-end encrypted the whole way.
Two ways to run it
Pick the path that fits how you operate:
In a hurry? The deployment configurator turns a list of servers and roles into one ready-to-run install script per box — the same systemd layout described below.
VPS setup (Ubuntu 24.04)
Released binaries on a fresh box, step by step. Best for evaluation and small deployments.
Start hereProduction (systemd)
Per-server bootstrap with persistent identity and a TLS-camouflage gateway. Best for real deployments.
Go to productionOn this site
- VPS setup (Ubuntu 24.04) — Stand up a server from released binaries, step by step.
- Production (systemd) — Per-server bootstrap with TLS-camouflage gateway.
- Servers & ports — Service roles, ports, transports, and management.
- Relay management — Default, Default + custom, and Full custom in the app.
- Bot API — Token auth, send, broadcast, priorities, rate limits.