UnoLock Federated Node

Run your own vault.

The same vault, on infrastructure you control. Your disks, your jurisdiction, your rules. Free and open source, with no trial and no paid activation.

Install your node Try Hosted instead

What you get

A complete node in one container

The Safe service, the browser app and the admin app
Encrypted messaging and shared Spaces across nodes
Tor for communication with other nodes
Automatic HTTPS certificate management
Registration codes, so you can run a node for yourself or invite others
Password-encrypted Space backups you can restore into another Safe
Free software under the GNU AGPL version 3

Who it's for

People who want the hardware

You need to be able to sign in to a server, run terminal commands, and change DNS and firewall settings. You do not need to build UnoLock or understand its cryptography.

Self-hosters who already run a server or VM
Families and teams who want one node for everyone, with invites
Organisations that want their data on infrastructure they control
Anyone who wants a home service of their own and still wants to share across nodes

Requirements

What you need

Server: 64-bit Intel/AMD (amd64) Linux with local persistent storage. It must stay on whenever you want to reach your Safes. A rented virtual server works.
Container engine: Docker Engine. The setup script checks Docker access but does not install it.
Hostname: A permanent name you control, such as node.example.com, with a DNS A record pointing at the server. Your passkeys are tied to it, so choose carefully.
Ports: Inbound TCP 80 and 443, plus TCP 9001 for the default non-exit Tor relay.
Browser: A current Chromium-family desktop browser, such as Chrome or Edge, with a working passkey or hardware security key.
TPM: Optional. TPM 2.0 enables unattended hardware sealing. Without it, an admin unlocks the node after each restart.

Full requirements

Install

From a Linux server to your first Safe

Secure the server before you expose it: keep the OS and Docker patched, restrict SSH and Docker access, use SSH keys and allow only the ports above. The container does not harden the host or configure its firewall for you.

Prepare the server
Install and start Docker Engine, then install Git and dig (dnsutils on Debian and Ubuntu). Confirm that sudo docker info succeeds.
Point your hostname at it
Choose a permanent hostname and point its DNS A record at the server's public IPv4 address. Publish an AAAA record only if IPv6 also reaches that server. Allow inbound TCP 80, 443 and 9001.
Run the guided setup
Enter your hostname when asked. The script builds the container and prints the admin URL and a private one-time setup code.
```
git clone https://github.com/TechSologic/unolock-federated-node.git
cd unolock-federated-node
sudo sh packaging/docker/run-node.sh --setup --build
```
Register as admin
Open the HTTPS admin URL in Chrome or Edge. Choose Register admin, enter the setup code, register your passkey and choose a PIN of the length you want, then choose Unlock Node. The setup code expires in 30 minutes.
Finish setup
Complete Setup, then Deploy, Client and Health, including signing the browser client.
Create your first Safe
In Safes, create a Safe registration code. Open your hostname, choose Create Vault and use that code. Save the recovery material, then try a note and a small file.

Keep the hostname. Your admin and Safe passkeys depend on it. Wait for trusted HTTPS before registering. After a restart, sign in to admin and choose Unlock Node again.

First setup Install guide Creating Safes The admin console Upgrading

Try it first

Run it on localhost

For a throwaway test on your own computer. Open http://localhost:43100/admin and use the one-time setup code from the logs. Keep using localhost, because switching to 127.0.0.1 changes the passkey hostname.

sudo docker compose -p unolock-local -f packaging/docker/docker-compose.dev.yml up --build -d
sudo docker compose -p unolock-local -f packaging/docker/docker-compose.dev.yml logs --no-color

To stop the test and keep its data:

sudo docker compose -p unolock-local -f packaging/docker/docker-compose.dev.yml down

Try it on localhost

Federation

Your node talks to other nodes

You choose where to host your Safe and who to share with. Nodes learn about each other through a distributed lookup network, not a central directory. Traffic between nodes travels over Tor onion services, and your browser connects to your home node over HTTPS.

Sealed on your device, routed over Tor, readable only by the person it's for.

How federation works Messaging across nodes Shared Spaces across nodes Tor and the relay

Security

What the node can and can't see

The browser encrypts Safe contents before sending them to the node
The node stores encrypted data and transports encrypted messages
The administrator cannot reconstruct missing user recovery material

Know the limits. The app delivered from your node and your active browser and device remain trusted. Malicious delivered code or a compromised active client can access data available to that session. The node also processes operational metadata such as sizes, timing and routing.

Security model Host security

Backups

Back it up like any server

Keep backups separate from the server, and test that you can restore them.

Container backup bundle
Live config.json, captured while stopped
Admin recovery security key and PIN
Operator-managed TLS certificate and key
TPM or admin-unlock recovery material
DNS control

A Receive Address is fixed to your node's onion service. Preserve the onion identity when you recover or replace hardware, or those addresses will have to be replaced.

Backup and recovery guide

Your node, your responsibility

You are the operator

Independently hosted nodes are not operated, administered or maintained by TechSologic Inc. An official software release does not make a node a TechSologic-operated or endorsed service.

Hosting, configuration and host security are yours
So are updates, access policies, availability, backups and recovery, and any legal obligations
TechSologic does not provide technical support for the node. Documentation is available for self-service
People with Safes on your node come to you with access and operational questions

Operator responsibilities and support

Hosted or Self-Hosted

Which one is for you

UnoLock Hosted

$30 a year. We run it. Runs in your browser with nothing to install and nothing to operate.

Open vault

UnoLock Self-Hosted

Free. You run it. No billing and no activation inside your node, and you decide on storage and registration.

Install your node

Built to outlast any one company

If we disappear

Operators can build and run the AGPL node independently and configure their own bootstrap peers. Continued operation depends on participating operators and reachable peers, not on TechSologic staying in business. This does not automatically recover data from a service that has shut down.

Source code on GitHub Open source licence All self-hosting documentation