Cozy
How to self host Cozy, a personal cloud and password manager
Installation
pacman -Syu opensmtpd erlang-nox freeglut cairo chafa ghostscript libheif libjxl libraw librsvg libwebp libwmf libxml2 libzip ocl-icd openexr openjpeg2 djvulibre pango imagemagick-doc nodejs nsjail
Apache CouchDB NoSQL database
/etc/couchdb/local.ini
[admins]
admin = plain-password
[couchdb]
single_node = true
[chttpd]
port = 5984
bind_address = 0.0.0.0
After starting CouchDB for the first time, plain-password will be replaced with the hashed version.
Tip
Set bind_address to 0.0.0.0 to access CouchDB from other nodes.
systemctl enable couchdb
systemctl start couchdb
Test to see if the service is running by running
curl http://127.0.0.1:5984/
You can now access the Fauxton admin interface by going to http://127.0.0.1:5984/_utils
Increase security single node setup
mkdir -pv /etc/systemd/system/couchdb.service.d
/etc/systemd/system/couchdb.service.d/10-bind-locally.conf
[Service]
Environment=ERL_EPMD_ADDRESS=127.0.0.1
/etc/couchdb/vm.args
-kernel inet_dist_use_interface {127,0,0,1}
/etc/cozy/cozy.yml
couchdb:
url: http://admin:MYSECUREPASSWORD@127.0.0.1:5984/
Register credentials
Retrieve the correct node name
curl -X GET http://admin:MYSECUREPASSWORD@127.0.0.1:5984/_membership
curl -X PUT http://admin:MYSECUREPASSWORD@127.0.0.1:5984/_node/"couchdb@127.0.0.1"/_config/admins/admin -d "\"MYSECUREPASSWORD\""
Configuring Cozy
cp /usr/share/cozy/cozy.example.yaml /etc/cozy/cozy.yml
/etc/cozy/cozy.yml
# server host - flags: --host
#host: 0.0.0.0
host: 192.168.0.207
# server port - flags: --port -p
port: 8080
# how to structure the subdomains for apps - flags: --subdomains
# values:
# - nested, like https://<app>.<user>.<domain>/ (well suited for self-hosted with Let's Encrypt)
# - flat, like https://<user>-<app>.<domain>/ (easier when using wildcard TLS certificate)
subdomains: nested
# administration endpoint parameters. this endpoint should be protected
admin:
# server host - flags: --admin-host
host: localhost
# server port - flags: --admin-port
port: 6060
# secret file name containing the derived passphrase to access to the
# administration endpoint. this secret file can be generated using the `cozy-
# stack config passwd` command. this file should be located in the same path
# as the configuration file.
secret_filename: cozy-admin-passphrase
# file system parameters
# file system url - flags: --fs-url
# default url is the directory relative to the binary: ./storage
# url: file://localhost/var/lib/cozy
# url: swift://openstack/?UserName={{ .Env.OS_USERNAME }}&Password={{ .Env.OS_PASSWORD }}&ProjectName={>
# Swift FS can be used with advanced parameters to activate TLS properties.
# For using swift with https, you must use the "swift+https" scheme.
#
# root_ca: /ca-certificates.pem
# client_cert: /client_cert.pem
# client_key: /client_key
# pinned_key: 57c8ff33c9c0cfc3ef00e650a1cc910d7ee479a8bc509f6c9209a7c2a11399d6
# insecure_skip_validation: true
# can_query_info: true
# default_layout: 2 # 1 for layout v2 and 2 for layout v3
# auto_clean_trashed_after:
# context_a: 30D
# context_b: 3M
# versioning:
# max_number_of_versions_to_keep: 20
# min_delay_between_two_versions: 15m
fs:
url: file:///var/lib/cozy
# vault contains keyfiles informations
# See https://docs.cozy.io/en/cozy-stack/cli/cozy-stack_config_gen-keys/
# to generate the keys
vault:
# the path to the key used to encrypt credentials
credentials_encryptor_key: /etc/cozy/vault.enc
# the path to the key used to decrypt credentials
credentials_decryptor_key: /etc/cozy/vault.dec
# couchdb parameters
couchdb:
# CouchDB URL - flags: --couchdb-url
# url: http://localhost:5984/
url: http://admin:MYSECUREPASSWORD@127.0.0.1:5984
# konnectors execution parameters for executing external processes.
konnectors:
# run connectors with node
# cmd: /usr/share/cozy/konnector-node-run.sh
# run connectors with nsjail
cmd: /usr/share/cozy/konnector-nsjail-run.sh
log:
# logger level (debug, info, warning, panic, fatal) - flags: --log-level
level: info
# send logs to the local syslog - flags: --log-syslog
syslog: false
# Registries used for applications and konnectors
registries:
default:
- https://apps-registry.cozycloud.cc/selfhosted
- https://apps-registry.cozycloud.cc/banks
- https://apps-registry.cozycloud.cc/
Configuring Cozy admin password
cozy-stack config passwd /etc/cozy/cozy-admin-passphrase
chown cozy:cozy /etc/cozy/cozy-admin-passphrase
chmod 600 /etc/cozy/cozy-admin-passphrase
Creating vault keys
cozy-stack config gen-keys /etc/cozy/vault
chmod 700 /etc/cozy
chown cozy:cozy /etc/cozy/vault.dec
chmod 600 /etc/cozy/vault.dec
chown cozy:cozy /etc/cozy/vault.enc
chmod 600 /etc/cozy/vault.enc
Enable service
systemctl enable cozy-stack
systemctl start cozy-stack
Creating an instance
Add an instance. You will be prompted for your Cozy admin password,
you might also pass it using COZY_ADMIN_PASSWORD env var
cozy-stack instances add cozy.wildw1ng.com --apps home,settings,store
You will then need to visit https://<instance>.example.tld/?registerToken=<token>
which requires you to have setup a reverse proxy.