To host a Bluesky Personal Data Server (PDS), rent a small VPS with a public IPv4 address, point your domain to it, open TCP ports 80 and 443, and run Bluesky’s official installer. The installer deploys the PDS and Caddy, obtains HTTPS certificates, and provides administration tools. You then verify the HTTPS health endpoint and repository WebSocket before signing in through the Bluesky web, iPhone, or Android app.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
Self-hosting makes you responsible for the server, DNS, TLS, backups, credentials, updates, firewall, and monitoring. The documented small deployment targets roughly one to 20 users, so treat it as an operational service rather than a one-time install.
As an Amazon Associate I earn from qualifying purchases.
What a self-hosted Bluesky PDS does
A PDS stores an account’s repository and serves that repository to the AT Protocol network. Bluesky clients are still the user-facing apps, but your VPS becomes the service responsible for keeping account data available and federating it with the wider Bluesky network.
That division matters when diagnosing problems. A user may be able to open the app while the PDS has a DNS, certificate, storage, or WebSocket problem. Conversely, a healthy PDS does not replace the need for a correctly configured handle or a client pointed at the right server URL.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The official distribution is designed as a small Docker Compose deployment fronted by Caddy. The supplied setup is the safest path for a new operator; replacing its reverse proxy or rearranging containers is an advanced configuration that creates additional TLS and WebSocket failure modes.
Choose the VPS and domain first
Documented small-deployment requirements
The current PDS documentation describes the following baseline for a small installation:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match| Requirement | Documented baseline | Why it matters |
|---|---|---|
| Public network address | Public IPv4 address | DNS and inbound client, federation, and certificate-issuance traffic must reach the VPS. |
| Operating system | Ubuntu 24.04 for the small deployment | The quick-install flow is also documented for Ubuntu 20.04, 22.04, and 24.04, plus Debian 11, 12, and 13. |
| Memory | 1 GB RAM | The stated minimum for the documented small setup. |
| CPU | 1 CPU core | The stated minimum for the documented small setup. |
| Storage | 20 GB SSD | Holds the PDS data directory, containers, logs, and operating-system files. |
| Recommended size | Approximately 1–20 users | This is the official recommendation, not a capacity guarantee for every workload. |
| Administration | Root or sudo access | The installer configures system services, Docker, networking, and data directories. |
Pick a VPS provider that supplies persistent SSD storage, a public IPv4 address, root or sudo access, and configurable cloud-firewall rules. The PDS documentation names DigitalOcean and Vultr as popular choices, but prices, bandwidth, regions, backups, and storage fees change, so there is no universal monthly cost to quote.
Use a domain you control
A public DNS name is part of the PDS identity. Decide whether the root domain will be the PDS hostname and whether the server will issue handles for additional users. The following example uses example.com and an illustrative IPv4 address.
| Name | Record | Value | When needed |
|---|---|---|---|
example.com |
A | Your VPS public IPv4 address | Always |
*.example.com |
A | The same VPS public IPv4 address | When the PDS will issue handles for multiple users |
A 600-second TTL is described as reasonable, although other TTL values can work. DNS changes are controlled by your DNS provider; do not assume the records are live until you query them from outside your VPS.
Open only the required public ports
In the provider’s cloud firewall, allow inbound TCP 80 and 443 from the Internet. Port 80 is used for certificate verification; normal application and federation requests use HTTPS on 443. Restrict SSH (TCP 22) to your own public IP whenever your provider allows it, and apply equivalent rules in the VPS’s local firewall if you use one.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Prepare a clean host
The quick installer assumes a reasonably fresh server and that no other web server is already listening on ports 80 or 443. Before running it:
- Apply the operating-system updates supplied by your VPS image.
- Confirm that the server’s clock is correct and that you can log in with sudo.
- Check that the public DNS records resolve to this VPS.
- Remove or stop any existing service that binds TCP 80 or 443, or design a deliberate reverse-proxy arrangement before installing.
- Confirm that the cloud firewall and any host firewall permit the required traffic.
If the VPS already hosts websites, do not blindly run the quick path. Decide which service owns each hostname and port, then configure routing, certificate issuance, and WebSocket forwarding as one design. The supplied Caddy configuration is the supported default.
Run the official PDS installer
The documented quick-install path downloads the installer and then executes it with sudo:
curl https://raw.githubusercontent.com/bluesky-social/pds/main/installer.sh > installer.sh
sudo bash installer.shYou can inspect the downloaded file before executing it. The script is intended for Ubuntu 20.04, 22.04, and 24.04 and Debian 11, 12, and 13; the small-deployment specification lists Ubuntu 24.04, 1 GB RAM, one CPU core, and 20 GB SSD.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →During the interactive run, provide:
- The public DNS name that will identify the PDS.
- An administrator email address for service administration and certificate-related notifications.
- Whether to create an initial PDS account, including its handle, email address, and password.
Use a password manager for every credential. The account-creation output warns that the password will not be displayed again, so losing it means using the documented administrative recovery path rather than copying it later from the terminal.
Let Caddy handle HTTPS
The supplied Docker Compose deployment includes Caddy. In the supported layout, Caddy obtains and renews TLS certificates and handles the HTTP-to-HTTPS behavior, so you do not need to create certificates manually or add a separate redirect.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Do not replace Caddy with Nginx or Apache unless you understand the consequences. The official troubleshooting guidance calls out certificates, WebSockets, and virtual server names as common failure points after changing the supplied configuration. A reverse proxy that serves ordinary HTTP but does not pass the repository WebSocket will leave federation incomplete.
Verify health and the repository stream
Check the HTTPS health endpoint
From a machine outside the VPS, request:
https://example.com/xrpc/_healthA healthy response is JSON containing a version. The documentation’s example is {"version":"0.2.2-beta.2"}; the exact version will change as the image is updated. A timeout, certificate warning, or non-JSON response points to DNS, firewall, Caddy, or container startup rather than to a Bluesky client problem.
Check the repository WebSocket
Use a WebSocket client such as wsdump:
wsdump "wss://example.com/xrpc/com.atproto.sync.subscribeRepos?cursor=0"The connection should remain open. A newly created PDS may be quiet until it creates an event, so an initially empty stream is not by itself a failure. The important checks are that the TLS handshake succeeds and the connection is not immediately rejected or closed. If the health endpoint works but this connection fails, inspect Caddy’s WebSocket forwarding and the virtual server name before changing application settings.
Create additional accounts
The image includes the goat command-line tool. The documented container invocation creates an account from the host:
docker exec pds goat pds admin account create
--admin-password "$PDS_ADMIN_PASSWORD"
--handle newuser.example.com
--email [email protected]
--password "$NEW_USER_PASSWORD"Set the two shell variables from a secure secret store or an interactive shell rather than writing real passwords into shell history. Replace the example handle and email with the values you intend to use. The wildcard DNS record is required when the PDS must issue new subdomain handles.
The installation also exposes pdsadmin for administrative tasks. Use the systemd-managed service and its logs to check whether the PDS and its containers are running; keep the data directory, /pds, protected from ordinary users.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Connect Bluesky clients to your PDS
The official instructions support the Bluesky web, iPhone, and Android apps. In the client’s server or service-provider field, enter the PDS URL, for example https://example.com, then sign in with an account created on that PDS.
The first certificate for a newly created subdomain is generated on demand. A new handle can therefore take about 10–30 seconds to become reachable. If the client reports a certificate or connection error immediately after account creation, wait briefly and retry before changing DNS or proxy settings.
Make federation an explicit acceptance test
“The app opens” is not enough to declare success. Treat these as separate acceptance tests:
- The PDS hostname resolves to the VPS public IPv4 address.
- HTTPS on port 443 returns the PDS health JSON.
- The repository WebSocket accepts a
wss://connection and stays open. - A test account can authenticate from a Bluesky client pointed at the PDS URL.
- An account with a subdomain handle becomes reachable after its certificate is issued.
Creating a small test event after the WebSocket test gives the stream something to emit, which helps distinguish a quiet but healthy repository from a disconnected one.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Operate the PDS as a service
Back up the complete data directory
Back up /pds, not just a database container. It is the location associated with the PDS service’s persistent data and credentials. Store encrypted copies outside the VPS, keep at least one copy in a different failure domain, and record when each backup was taken.
A backup is useful only if it can be restored. Periodically test a restore on an isolated VPS or a disposable directory, document the exact image and configuration used, and verify that the restored service can answer the health endpoint before considering the exercise complete. Provider snapshots are convenient, but they should supplement an export you control rather than replace it.
Protect credentials and administrative access
- Use unique, long passwords for the PDS administrator and every account.
- Keep password values out of public shell history, tickets, screenshots, and chat transcripts.
- Limit SSH to trusted source addresses, disable unused login methods, and protect private keys.
- Give the VPS provider account multi-factor authentication and a separate recovery path.
Patch and monitor
Apply operating-system and PDS image updates on a schedule, after confirming that a recent backup exists. Watch disk usage, memory pressure, certificate renewal, container restarts, and the systemd service logs. A 20 GB disk can fill through logs or repository growth even when CPU and RAM remain quiet.
Recommended Free Tools
Retest /xrpc/_health after maintenance and periodically test the repository WebSocket from outside the VPS. Monitoring only the TCP port can miss an unhealthy application, while monitoring only the health endpoint can miss a broken WebSocket path.
Troubleshoot the failures that matter most
| Symptom | Likely cause | Action |
|---|---|---|
| DNS returns an old address or no address | A or wildcard record is missing, incorrect, or still cached | Query the records from an external network, correct the value, and wait for the record’s TTL to expire. |
| Certificate issuance fails | Port 80 is blocked, DNS points elsewhere, or another web server owns the port | Allow TCP 80, verify the public IPv4 address, and stop or reconfigure the conflicting listener. |
| Health endpoint times out | Port 443 is blocked, Caddy is stopped, or the containers did not start | Check cloud and host firewalls, inspect the systemd and container status, then read service logs. |
| Health works but WebSocket closes | Reverse-proxy or virtual-host configuration does not pass WebSocket upgrades | Restore the supplied Caddy arrangement or explicitly configure WebSocket forwarding and the correct hostname. |
| WebSocket stays empty | The new repository has not produced an event | Create a test event; an empty stream alone does not prove failure. |
| A new handle is unreachable for a short period | Its on-demand subdomain certificate is still being created | Allow roughly 10–30 seconds, then retry. If it persists, check wildcard DNS and Caddy logs. |
| Account creation is rejected | Wrong administrator password, invalid handle DNS, or a command run outside the PDS container | Use the container command with the correct administrator credential, verify the handle format and wildcard record, and review the command output. |
| Installer reports a port conflict | An existing website or reverse proxy is listening on 80 or 443 | Move that workload, choose a deliberate shared-proxy design, or use a clean VPS for the PDS. |
Know when the baseline is no longer enough
The documented 1 GB, one-core, 20 GB configuration is aimed at approximately one to 20 users. More accounts, larger repositories, heavier logging, or additional services on the same VPS increase resource and operational risk. Before scaling, measure memory, CPU, disk growth, and restart frequency rather than assuming that adding users requires a particular fixed server size.
For a larger installation, separate the PDS from unrelated websites, increase SSD capacity before it is nearly full, and make backups and restore testing routine. Keep the public DNS and handle plan stable so that a later move can preserve account identity. A migration plan should state how you will copy /pds, lower DNS TTLs before a move, validate the new health and WebSocket endpoints, and retain the old server until the new one is proven.
Self-managed versus managed hosting
Running the PDS yourself gives you direct access to the VPS, its files, and its update schedule. A managed service trades that access for someone else’s responsibility for Docker, Caddy, patching, backups, and incident response. Compare providers on the following questions rather than on a headline price:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteQuick Recap
| Decision point | Self-managed VPS | Questions for a managed service |
|---|---|---|
| Operational access | You control the host, containers, and data directory. | Can you obtain logs, exports, and administrative access when needed? |
| Backups | You design, encrypt, store, and test them. | What is backed up, how often, where is it stored, and how is restoration tested? |
| Custom domains and handles | You control DNS, certificates, and wildcard records. | Are custom domains and subdomain handles supported, and who handles certificate failures? |
| Migration | You can move the VPS and /pds yourself. |
Can you export all repository data and credentials in a documented format? |
| Federation compatibility | You test the health endpoint and repository WebSocket. | Who responds when federation, WebSockets, or certificates fail? |
| Recurring cost | VPS, storage, snapshots, bandwidth, and your time. | Service fee plus any limits for users, storage, bandwidth, or support. |
Before inviting real users
- Confirm both the root A record and wildcard A record resolve correctly where applicable.
- Verify TCP 80 and 443 from the public Internet and restrict SSH access.
- Store an encrypted backup of
/pdsoutside the VPS and perform a restore test. - Test the health URL and repository WebSocket after a reboot or upgrade.
- Create a test account, wait for its on-demand certificate, and sign in from a Bluesky client.
- Record the administrator credentials, recovery procedure, update schedule, and monitoring alerts in a private runbook.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
