Run the relay and the tunnel server yourself
Run the relay and the tunnel edge on a box you own, on any plan. Ours step out of the path.
$ curl -fsSL https://get.pprbt.dev/selfhost/install | sh -s -- --enable both$ pbh selfhost code# Console → Network → Add self-hosted node- 1
On a Linux server with a public address. Installs
pbh, which runs a relay, a tunnel server, or both. - 2
Prints an address and a one-time code that lasts fifteen minutes.
- 3
Paste them in, and pick the workspace that owns the node.
What runs on your server
Direct connections between machines never touched a server in the first place. These are the two paths that did.
Your relay
When two of your machines cannot connect directly, they meet at your server instead of ours. It still sees only ciphertext.
Your tunnel server
Visitors to your previews and tunnels connect to your server, on your domain. Their HTTPS ends on a box you run.
- Encrypted between your machines. Nothing in the middle can read it.
- HTTPS. Encrypted to the edge, which reads the request to route it.
With a self-hosted relay, relayed traffic between your machines passes through your server, end-to-end encrypted. With a self-hosted tunnel server, visitors connect over HTTPS to your server, which forwards to your machine.
Requirements
The default install is a relay only. Add --enable tunnel or --enable both for a tunnel server.
| Server | Ubuntu 22.04 or 24.04, or Debian 12, on amd64 or arm64, with a public IP address. |
|---|---|
| What gets installed | The pbh helper, Docker if it is missing, and the relay and tunnel images, run as a system service. |
| Domain | None needed for a relay. A tunnel server serves your own domain, with a certificate you provide for its host name. |
| Bandwidth | Traffic through your servers is never counted against your plan. |
| File transfers | Unlimited mode sends any size through your own relay. |
| Public TCP tunnels | No limit on addresses on an edge you host. |
| Upgrades | Run the install line again. It upgrades in place and keeps its data. |
| Plans | Every plan, Free included. |
Questions
Can I self-host all of Paperboat?
Not as a supported product. Sign-in, authorization and machine records stay with the hosted control plane. What you can run yourself are the two servers that carry traffic: the relay and the tunnel edge. The control plane never sees the contents of your private traffic either way.
Why would I run my own relay?
To keep relayed traffic on a server and a network you choose, to stop counting bandwidth, or to send files of any size. In the console you can keep relayed traffic on your own relays only.
Can I mix my tunnel server with Paperboat's?
Not within one workspace. For previews and tunnels a workspace uses either Paperboat's edges or your own, so that it is always clear who terminates your visitors' TLS. Relays can be mixed.
How do I check a node is healthy?
pbh status shows the service, and pbh doctor checks the host, its network and its ports and tells you what to open on your cloud firewall. The console's Network page shows each node with its latency.
Is the source available?
Yes. The repository is open source: the client, relay and tunnel edge are MIT, the server and console AGPL-3.0. You may read, build, modify and self-host all of it.
Related
Start with the machine in front of you
Install Paperboat here, then on a second machine. Free for personal use, no card needed.
$ curl -fsSL https://get.pprbt.dev/install | bash > irm https://get.pprbt.dev/install.ps1 | iex