self-deploy

run your own relay. your server, your rules. free, forever. one binary, agpl, unlimited devices and storage.

what you get

shizumu syncs through a relay: a small server that passes end-to-end encrypted blobs between your devices. it never sees your writing — only ciphertext. self-deploy means you run that relay yourself, so nothing touches anyone else's machine. it is the same binary we run for the hosted tier, with no separate database service to manage.

what you need

• a small linux server. a low-end vps or a pi-class box is plenty.
• a domain or subdomain pointing at it.
• https in front. the app refuses a plain http relay, except on localhost.
• rust 1.95 or newer to build, or the docker image.

get the relay

git clone https://github.com/shizumu-app/shizumu-relay
cd shizumu-relay
cargo build --release
# the binary lands at target/release/shizumu-relay

a dockerfile and a docker-compose example ship in the repo if you prefer containers.

bootstrap your user

the relay is single-user by default: one account, your devices. create it once. the command prints a one-shot enrollment token, valid for an hour.

shizumu-relay init-user --pub <your-device-pubkey>
# prints user_id and enrollment_token

the app shows the device pubkey in settings, sync, when you choose "my own relay".

run it

configuration is a few environment variables. keep them in a root-owned file such as /etc/shizumu/relay.env, mode 600.

SHIZUMU_BIND=127.0.0.1:8080
SHIZUMU_DB=/var/lib/shizumu/relay.db
SHIZUMU_STORAGE=fs:///var/lib/shizumu/blobs

storage backends: fs for a real disk, sqlite for a single-file nano deploy, s3 for minio, garage, r2, or any s3-compatible store. the index always lives in relay.db.

run it under systemd so it survives reboots:

[Unit]
Description=shizumu relay
After=network-online.target

[Service]
EnvironmentFile=/etc/shizumu/relay.env
ExecStart=/usr/local/bin/shizumu-relay serve
User=shizumu
Restart=on-failure

[Install]
WantedBy=multi-user.target

put it behind https

terminate tls in front of the relay. caddy is the shortest path:

sync.example.com {
  reverse_proxy 127.0.0.1:8080
}

with nginx, allow attachment-sized bodies — the client sends up to 100 mb, so the proxy limit must sit above it:

client_max_body_size 110m;

point the app at it

open shizumu, settings, sync, and choose "my own relay". set the relay url to https://sync.example.com and paste the enrollment token on your first device. add each other device with the short pairing code the first one shows. your writing now syncs through your own server, end to end encrypted.

backups and upgrades

back up relay.db (litestream works well) and the blob store; both hold only ciphertext. to upgrade, pull, rebuild, restart — migrations run on start. the full operator handbook, including log redaction, monitoring, and maintenance commands, lives in the repo at docs/operator.md.

the deal

self-deploy is free, forever, under the agpl. the hosted tier exists for people who would rather not run a server; it funds the work. same binary, same encryption, your choice.