✨🚨100% VIBES🚨✨ - This app was prompted using ai tools and has had no human eyes on the code.

Run your own sovereign identity and homeserver on the Pubky network — no DNS, no hosting provider, no middlemen.

Pubky Node is a single binary that bundles everything you need to participate in the Pubky ecosystem: a Mainline DHT node, a Pkarr relay, a sovereign DNS resolver, a Pubky Homeserver with embedded PostgreSQL, Cloudflare Tunnels for instant public access, and a polished web dashboard to manage it all.

Download the installer for your platform from Releases:

The desktop app runs as a system tray application — close the window to minimize to tray, the node keeps running in the background.

cargo build --release
cargo run --release

# Without DNS resolver (no pkdns binary needed)
cargo run --release -- --no-dns

# Custom ports
cargo run --release -- --relay-port 8080 --dht-port 6882 --dashboard-port 3000

Then open http://localhost:9090/ in your browser.

docker build -t pubky-node -f pubky-node/Dockerfile .

docker run -p 9090:9090 -p 6881:6881/tcp -p 6881:6881/udp \
  -v pubky-data:/data \
  pubky-node

Pubky Node is available as a one-click Umbrel app. See the Umbrel deployment guide.

The web dashboard at http://localhost:9090/ provides a full management interface:

When you launch Pubky Node, it automatically:

1. Starts a DHT node — joins the ~5M peer Mainline DHT network
2. Starts the Pkarr relay — HTTP API for DNS packet resolution
3. Starts embedded PostgreSQL — zero-config database for the homeserver
4. Starts the homeserver — your personal Pubky data store
5. Starts a Cloudflare tunnel — instant public URL, no port forwarding needed
6. Publishes your PKARR record — so the network can find your homeserver
7. Starts PKDNS — local DNS resolver for .pkarr / .key domains
8. Starts the HTTP proxy — browse sovereign domains in any browser

Everything is automatic. Open the dashboard, unlock the vault, and you're live on the Pubky network.

Point your browser at the local PKDNS resolver to browse .pkarr and .key domains. Normal DNS queries are forwarded to 8.8.8.8, so regular browsing is unaffected.

sudo mkdir -p /etc/resolver
echo "nameserver 127.0.0.1" | sudo tee /etc/resolver/pkarr
echo "nameserver 127.0.0.1" | sudo tee /etc/resolver/key

# /etc/systemd/resolved.conf.d/pubky.conf
[Resolve]
DNS=127.0.0.1
Domains=~pkarr ~key

sudo systemctl restart systemd-resolved

1. Settings → Network & Internet → Wi-Fi/Ethernet
2. Click your connection → DNS server assignment → Edit
3. Set Preferred DNS to 127.0.0.1, Alternate to 8.8.8.8
4. Save

Browsers with "Secure DNS" (DoH) bypass local resolvers:

• Chrome/Edge: Settings → Privacy & Security → Use Secure DNS → Off
• Firefox: Settings → Privacy → DNS over HTTPS → Off

The dashboard manages all configuration through the UI. For advanced use, create config.toml in your data directory:

[relay]
http_port = 6881

[dht]
port = 6881

[dns]
enabled = true
forward = "8.8.8.8:53"

[watchlist]
enabled = true
keys = ["yg4gxe7z1r7mr6orids9fh95y7gxhdsxjqi6nngsxxtakqaxr5no"]
republish_interval_secs = 3600

Data directory: ~/Library/Application Support/pubky-node/ (macOS) or ~/.pubky-node/ (Linux). Override with --data-dir.

Pubky Node includes a full CLI alongside the dashboard:

# Daemon
pubky-node run [--relay-port 6881] [--no-dns] [--no-upnp]

# Standalone tools
pubky-node resolve <KEY> [--json]
pubky-node publish --secret-key <HEX> --record "A @ 1.2.3.4"
pubky-node keygen [--json]
pubky-node vanity <PREFIX> [--suffix] [--threads N]

# Homeserver
pubky-node homeserver status|start|stop|check|users|token|publish-pkarr|logs

# Tunnel
pubky-node tunnel status|start|stop|check

# Watchlist
pubky-node watchlist list|add|remove <KEY>

# Node control
pubky-node node restart|shutdown

pubky-node (supervisor)
├── pkarr-relay (HTTP + DHT node)
│   ├── pkarr::Client (SignedPacket publish/resolve)
│   └── mainline::Dht (BEP44 routing table, ~5M peers)
├── homeserver (subprocess)
│   ├── embedded PostgreSQL (auto-managed, port 5433)
│   └── PKARR key republisher
├── tunnel-manager (cloudflared subprocesses)
│   ├── homeserver tunnel (auto-start, PKARR auto-publish)
│   ├── relay tunnel
│   └── DNS tunnel (DoH)
├── key-vault (encrypted: argon2id + ChaCha20-Poly1305)
├── watchlist (periodic DHT republisher)
├── pkdns (subprocess: .pkarr/.key DNS resolver)
├── http-proxy (port 9091)
├── upnp (async port mapping)
├── backup (periodic remote homeserver sync)
└── dashboard (port 9090)
    ├── embedded HTML/CSS/JS (no build step)
    ├── /api/* endpoints (auth-protected)
    └── password-protected web UI

• Dashboard binds to localhost only by default
• All API endpoints require password authentication
• Key vault uses argon2id key derivation + ChaCha20-Poly1305 AEAD encryption
• Secret keys are zeroized in memory after use
• Security headers on all responses (CSP, X-Frame-Options, nosniff)
• Rate limiting on resolve endpoints

cargo test                              # run tests
cargo clippy                            # lint check

# Desktop app build
bash scripts/build-sidecars.sh --release  # compile sidecars
cargo tauri build                         # build .dmg / .exe / .deb

MIT