Various SBCs can be used as servers. Private on the Net currently offers images for these SBCs:

I have also tried other SBCs, such as Orange Pi Zero, Raspberry Pi Zero, Odroid U2, and Cubie A5E. Some of these devices do not have enough power, have too little memory, tend to crash due to overheating, or are simply no longer available (or difficult to obtain).

If you want to use an existing SBC, you should download an Armbian or Raspbian image as a basis and extend this image using the conversion script from https://codeberg.org/sven-ola/privat-in.

If you want to buy a new SBC, the ones mentioned above are quite good and inexpensive and available on Amazon, eBay, or Aliexpress. Of course, you can also check out Reichelt, Conrad, Pollin, or Völkner. Brick-and-mortar retailers in Germany do not usually sell such devices.

SBCs are usually sold with various accessories: power supply, USB cable, case, heat sink, and SD card are included in any combination at an additional cost. To make your own case using 3D printing, you can download a suitable STL file from Thingyverse or Printables.

For some selected SBCs, you can find source files in the project repository under /housing. The *.scad files can be converted to *.stl format using OpenSCAD, allowing you to import them into 3D printing software.

Your computer or smartphone already has everything you need: a Wi-Fi module, an optional Ethernet connection, and a web browser are always available. If you don't use password management yet, I strongly recommend installing and trying out password management software or a password app. For beginners, KeePassXC Password-Manager Password Manager is a good choice.

Of course, you can also save passwords in your web browser settings. By logging into one of the major cloud providers with your web browser, these passwords can also be synced across multiple devices. At this point, at the latest, you will start receiving personalized advertising. But first, there is a reason why important services such as banks, developer websites, or government agencies often require two-factor authentication today: without 2FA, it may be more convenient, but it is also prone to user errors or worse. And second, I would never entrust the security of my passwords to an unknown cloud provider. Furthermore, Private on the Net is also about digital independence, and a password manager is simply part of that.

An “image” is a file containing a disk image. The Private on the Net images contain a U-Boot bootloader, a Linux kernel, a Linux startup environment (“Initramfs”), and a selection of pre-installed software (“userspace program packages”). An image file is between 2 and 3 GB in size, so downloading and transferring it to an SD card takes a few minutes. You can find my images on the Private on the Net project server at https://privat-in.de/downloads/.

You will need a notebook or desktop computer with a micro SD card adapter. Micro SD cards can also be written to using a simple mechanical adapter with a “large” SD card adapter. You can also use a micro SD card adapter on the USB port.

Many Linux users are familiar with this: a bootable SD card can be written using a command line command. It would be a fatal mistake to overwrite the wrong device here. Therefore, check the target device specification (of=) very carefully.

sudo dd if=sd.img of=/dev/mmc<number> bs=1M status=progress && sync

Other operating systems prevent direct access to storage media and therefore require additional software. There are all kinds of utility programs available for Windows, such as Rufus. It should also work with the built-in tools in macOS, but there are utility programs available for this too. There are good descriptions of this topic on the Internet; just search for “Raspberry Pi image write Windows macOS Linux”.

The following steps will lead to a running SBC:

The first start may take a few minutes. During this time, the Linux startup environment will set up the larger part of the SD card with an encrypted file system. During this process, the green LED on the SBC should flash (“Disk Activity”). Another LED on the Ethernet port (“Net Activity”) should light up green or blink.

For troubleshooting and analysis, I can only provide some tips here. Are the connection cables plugged in correctly? Is the SD card inserted correctly? Was the SD card written with the correct image? Connecting an HDMI monitor and a USB keyboard may help. Alternatively, the startup process can be analyzed using a serial UART connection. In this state, the password “admin” is set for the “root” user.

After the initial start-up and with an Internet access device connected via Ethernet, the SBC's WiFi radio module switches to access point mode. The SBC then transmits a radio identifier with the IPv4 address of the Ethernet connection: “privat-in.de (192.168.x.x)”. You can now open the web interface for installation.

Start with a smartphone

Start with a computer or notebook

Installing with the web interface

The web interface displays three buttons: Install, Restore, and Delete All.

Clicking the Install button will take you to another page explaining the process that follows. Here, you start the installation script by clicking the Install button again. The output of the script is now displayed continuously on a web page. The script installs updates, downloads the Nextcloud software, installs it, and adjusts the system configuration for Nextcloud. This process takes about 15 minutes.

Wait until the message *** INSTALLATION COMPLETE *** appears. At this point, the Activate button will open a new page with the encrypted HTTPS protocol. Since no “official” website certificates are issued for local IPv4 addresses, your web browser will now warn you of a possible security risk. On the Internet and on public websites, you should take this warning seriously and leave the website. Here, however, you must accept the risk. The usual buttons for this are Advanced... and Accept risk and continue (or similar).

The activation page now displayed with a blue background already belongs to the NextCloudPi you just installed. Two randomly generated passwords are shown here. You must copy both passwords into your password manager:

To copy the passwords, click on the icons displayed next to them. Activate the passwords using the Activate button at the bottom of the page. Your web browser will then switch to the NextcloudPi panel on port 4443. With the changed port number, you must again accept the security risk of a local website connection. In the following password dialog, you must enter the account name “ncp” and copy the shorter password from your password management system.

One of the first settings you should configure is the host or computer name for the SBC, as this name is used in many different places. You can find this setting in the PRIVAT_IN menu on the left under Change host name.

The web browser security warnings make your Nextcloud virtually unusable. That's why you need a website certificate. You can connect any DNS name to a free website certificate. There are two requirements for this: You can run the Letsencrypt software on your server, and port 443 of your server is actually accessible from the Internet with the specified DNS name.

It's done, and your Nextcloud can now be accessed from anywhere in the world. You will be greeted by the login dialog, where you can enter the account name “ncp” and the password you received earlier for your Nextcloud admin account (the shorter password from Installation with Captive Portal). You can conveniently save this password in your web browser.

The next steps depend on your application requirements. You can find reading material on this topic on the Internet, for example the Introduction by Nextcloud GmbH. You should first carry out the following steps:

There are various apps available for the Android smartphone operating system that allow you to synchronize files, passwords, addresses, and calendar entries between different devices. You can install these apps using Google Play or F-Droid.

Each newly installed app is usually registered indirectly via the Android web browser:

You can manage the access permissions you have granted in the web interface of your Nextcloud. In the main menu, go to the Personal Settings menu item. The Security page displays the access permissions you have granted. You can revoke access permissions here.

On a desktop computer, the exact procedure depends heavily on the operating system installed. With a current version of Linux, you can usually install the appropriate software with the “Nextcloud Desktop” package. For MacOS and Windows, you can download a file synchronization program from the Nextcloud GmbH website: Download and install Nextcloud. General explanations on how to configure the file synchronization program can also be found on this website.

When setting up the file synchronization program, all folders and files are synchronized from the server to your user directory on your computer by default. In Windows, replacement with virtual files (“shortcuts”) is also offered.

There are two different approaches for integrating your Nextcloud contacts and Nextcloud addresses:

Using a Cinnamon desktop on Linux as an example, a Nextcloud online account can be set up in this way:

Good instructions for various email programs can be found on the Internet, for example, Synchronizing with Thunderbird from Nextcloud GmbH. For Microsoft Outlook on Windows, setup using CardDAV and CalDAV can currently only be done with additional software:

You can also configure this setting on other operating systems or with other programs using this method.

If you don't have a suitable SBC available at the moment, you can also set up Private on the Net in a virtual machine. To do this, you need to install virtual machine software on your desktop computer or notebook. Virtualbox, VMWare, or Linux KVM software should work. The following description shows how to set up a virtual machine using Virtualbox software.

The virtual machine is now set up and ready to start. During startup, the current IP address of the virtual machine is displayed before the login prompt. The rest of the installation is carried out using the HTTP web interface at this IP address, as described above.

The prerequisite is that you have the consent of one or more backup providers to store your backups. From here, you can set up one or more backups by following these steps.

If you have set up multiple backup addresses, your backups will be uploaded to a different backup destination each night. You can continue to use your Nextcloud during the nightly backup. The process is initiated with an LVM2 snapshot, which only takes a few moments. The device key is then removed from the snapshot and the entire SD card image is synchronized with the remotely stored version. This process takes longer if a lot of new data has been stored since the last backup. During the upload, the performance of your Nextcloud is slightly limited.

It's happened: you want to restore an existing backup. To do this, you need the following items:

First, you must write one of the Private on the Net image files to the SD card. This works as described under Download Image and Write to SD Card. Then, follow the steps that lead to the captive portal page being displayed (see Installation with Captive Portal).

In the event of an error, the red LED will flash continuously. It may help to repeat the process. If that does not work, you can also ask the backup provider to give you the stored image. If you transfer the image directly to a partition on a USB stick or SD card, you can open the encrypted data carrier with a Linux desktop system. After entering your backup password, you will have direct access to your Nextcloud files.

From time to time, you should update the Nextcloud software. You can find the latest versions at https://docs.nextcloud.com/. An update takes about 15 minutes. Your Nextcloud will be unavailable during this process.

As a backup provider for other Private on the Net SBC operators, you can offer backup storage space. To do this, you need fast Internet access, the ability to forward ports on your Internet access device, and an unused USB hard drive.

Follow these steps to set up your SBC for storing backups:

Backups can now be stored on your SBC. Please note that backup users can only call up exactly one script via the authorized_keys file: /usr/bin/privat-in-receive-backup. Please also note that the script /etc/rc.local sets a spindown after 30 seconds without access for the USB hard drive.

The bandwidth load for your Internet access can be high when many newly created backup users upload their first backup. During normal operation, this is significantly less. However, you should expect at least 64 Mb of downloads and 2 Mb of uploads per day and backup user, plus the additional files saved by the backup users since the last backup.

The reception script assigns a “time penalty” for each new action. This is intended to slow down actions that are particularly memory- or computation-intensive. However, the only way to combat particularly “creative” minds may be to delete the SSH key used from the list.

If you operate a Synology DiskStation, you can use it to offer backup storage as a backup provider for other operators of a Private on the Net SBC. To do this, you need to import a Docker image onto your DiskStation and use it to set up separate storage access for other participants.

Operating instructions

During the initial start of the “privat-in-backup” container, new files are written to the assigned data folder. These are initially files with generated host keys for SSH. These make the running container identifiable for the SBC of the backup users. Before uploading a backup, a check is performed each time to ensure that these host keys are unchanged. Existing host keys are not overwritten when the container is restarted or updated.

In addition, a new file called authorized_keys.txt is created. This file initially contains the public keys of the Private on the Net development devices. You can add new public keys to this file or delete unwanted public keys. The contents of this file are transferred to the container when it is restarted. Underscores are replaced by spaces and line end characters inserted by different operating systems or text editors are corrected.

To update, first stop the running container. Then delete both the Private on the Net container and the associated image. The data directory must be retained. Then repeat the installation as described above.

If you are running a Debian system with an X86 CPU with 64-bit architecture, you can also offer backup storage space as a backup provider for other Private on the Net SBC operators. To do this, add a new package source to your Debian system, install a suitable software package, and create a new user. In addition, your Debian system should be accessible externally via SSH.

Now you can upload an initial backup from an existing Private on the Net installation.

Operating instructions

The updates available from time to time, in particular for the privat-in-receive-backup script, are available as usual via the Debian update system.

The uploaded image files are so-called sparse files. They take up less space than indicated because there are unwritten file areas that serve as “storage holes”. This is a feature of the storage file system (Ext4 or Btrfs). If you want to change the storage location for the image files, you must use a file system with sparse support.