# Start9 Documentation > Documentation for Start9 products including StartOS, StartTunnel, Service Packaging, Bitcoin Guides, StartWRT, Start9 Support. Per-book indexes: - [StartOS](https://docs.start9.com/start-os/llms.txt) - [StartTunnel](https://docs.start9.com/start-tunnel/llms.txt) - [Service Packaging](https://docs.start9.com/packaging/llms.txt) - [Bitcoin Guides](https://docs.start9.com/bitcoin-guides/llms.txt) - [StartWRT](https://docs.start9.com/start-wrt/llms.txt) - [Start9 Support](https://docs.start9.com/support/llms.txt) Full content: https://docs.start9.com/llms-full.txt ## StartOS ### Getting Started #### [Installing StartOS](https://docs.start9.com/start-os/installing-startos.html) This guide is for flashing StartOS to a USB drive, then installing it onto a desktop, laptop, or mini PC. StartOS is built for x86_64 (Intel and AMD), ARM64 and RISC-V hardware, and for the Raspberry Pi 4. For an up-to-date list of known-good hardware, please check out this forum post; for servers Start9 sold, see Start9 Hardware. For Raspberry Pi, which does not use the USB installer, see Raspberry Pi below. Sections: Watch The Video, Download, Verify your download, Flash, Install, Raspberry Pi #### [Update to StartOS 0.4.0](https://docs.start9.com/start-os/update-040.html) StartOS 0.4.0 is a completely new operating system. There are two ways to update to it, both of which preserve your services and data and migrate them to the new format — but they are not equally reliable: - A flash update — you boot the 0.4.0 installer from a USB drive and install it over your existing server. This is the recommended method. - An over-the-air update — your server downloads 0.4.0 itself and applies it on the next restart. Both are covered in Install StartOS 0.4.0 below. > Raspberry Pi cannot update over the air. A Pi flash update uses the 0.4.0 Raspberry Pi microSD image rather than a USB installer. Complete Prepare Your Server below, then follow the Raspberry Pi flashing instructions. The preparation steps are not optional: complete Prepare Your Server before updating. > Follow every step carefully — skipping the service update or backup steps can result in permanent data loss. > > Backups from StartOS 0.3.5.1 cannot be restored onto 0.4.0, and vice versa. The 0.3.5.1 backup you create before migrating can only be used to roll back to 0.3.5.1. Sections: Before You Begin, Prepare Your Server, Install StartOS 0.4.0, After the Update, Post-Migration Notes #### [Surge Protector and UPS](https://docs.start9.com/start-os/surge-and-ups.html) Protecting your server from power events is essential. A surge protector is the minimum requirement for safely operating a server, and an uninterruptible power supply (UPS) is strongly recommended on top of that. This page explains why both matter, what to look for, and how to set them up. Sections: Why a UPS matters, Types of UPS, What to look for, How to set it up, Automatic shutdown on low battery #### [Initial Setup](https://docs.start9.com/start-os/initial-setup.html) After installing StartOS, follow these steps to initialize your server, set a master password, and download your Root CA. Sections: Watch The Video #### [Trusting Your Root CA](https://docs.start9.com/start-os/trust-ca.html) In order to establish a secure (HTTPS) connection with your server on the local network, it is necessary to download and trust your server's Root Certificate Authority (Root CA). Your server creates its Root CA during setup and keeps it across updates. Devices that already trust it remain trusted when you update StartOS. > You must repeat this guide for each device you want to connect to the server locally or using a VPN. This guide is not necessary for devices that will connect using Tor or clearnet. Sections: Watch the video, Step 1 - Download, Step 2 - Trust, 3. Mozilla Apps (Firefox, Thunderbird, Librewolf) ### Services #### [Marketplace](https://docs.start9.com/start-os/marketplace.html) The Marketplace is where you discover services to install on your StartOS server. It is a collection of independent registries, like stores in a mall, each offering its own curated list of services. Sections: Registry System and Navigation, Open Ecosystem #### [Default Registries](https://docs.start9.com/start-os/default-registries.html) StartOS ships with two registries preloaded in the Marketplace. Sections: Start9 Registry, Community Registry #### [Alternative Registries](https://docs.start9.com/start-os/alternative-registries.html) Beyond the default registries, you can add alternative registries to your Marketplace. Custom registries are useful for organizations packaging services for their own users, developers distributing services outside the default registries, or communities curating specialized collections. To switch between registries or add new ones, click "Switch" beneath the current registry title in the sidebar. > Start9 does not vet, endorse, or support services from custom registries. Exercise caution and only add registries you trust. Sections: Known Third-Party Registries, Hosting an Alternative Registry #### [Installing](https://docs.start9.com/start-os/installing.html) There are several ways to install and manage services on StartOS. Sections: From the Marketplace, Sideloading, Updating, Downgrading, Switching Flavors, Running a Second Copy #### [Updating](https://docs.start9.com/start-os/updating.html) StartOS makes it easy to keep your services up to date. When updates are available, a badge appears on the Updates tab in the top navigation bar showing the number of pending updates. Sections: Using the Updates Tab, Switching Registries, Updating from the Marketplace #### [Sideloading](https://docs.start9.com/start-os/sideloading.html) Sideloading lets you install a service from a .s9pk file without using any registry. This is useful when testing a service in development, installing a service that is not listed on any registry, running a second copy of a service, or if you prefer to eliminate the Marketplace as a point of trust. Sections: How to Sideload, Obtaining `.s9pk` Files #### [Flavors](https://docs.start9.com/start-os/flavors.html) Flavors are different services that share the same package ID. They are different implementations of the same protocol and data schema — for example, Bitcoin Core and Bitcoin Knots. Because they share the same data schema, flavors tend to satisfy the same dependent services, such as a lightning node or an Electrum server. Sections: Version Format, Limitations, Switching Flavors #### [Interfaces](https://docs.start9.com/start-os/interfaces.html) A service interface is a network endpoint exposed by a service running on your server. Every installed service exposes one or more interfaces, each serving a different purpose. The service interfaces for a given service are listed under the Interfaces tab in the sidebar of its service details page. Sections: Interface Types, Opening a UI, Viewing Interface Addresses #### [Instructions](https://docs.start9.com/start-os/instructions.html) Every service installed on StartOS ships with an Instructions page, accessible from the Instructions tab in the service details page sidebar. Instructions are written by the package's developer for you, the person actually running the service — they explain what the service is, walk you through getting it set up on StartOS, and tell you how to use it once it's running. Sections: When to Read Them, What's In Them, Instructions vs. README, Missing or Empty Instructions #### [Actions](https://docs.start9.com/start-os/actions.html) Actions are GUI representations of commands, API calls, or scripts that a system administrator would ordinarily run on the command line — complex, often dangerous operations that require time and expertise. In StartOS, service developers wrap these tasks into simple buttons with optional validated form input, making them accessible to anyone. They appear in the sidebar of the service details page. Sections: Examples, Using Actions, When Actions Are Available, Warnings #### [Health Checks](https://docs.start9.com/start-os/health-checks.html) Health checks monitor whether a service is ready and functioning. They appear on the dashboard alongside each running service. Health checks can be conditional — appearing or disappearing depending on what features are enabled or the current state of the service. Sections: Statuses, What Gets Checked, Internal Checks #### [Tasks](https://docs.start9.com/start-os/tasks.html) Tasks are notifications that prompt you to take action on a service. They appear on the dashboard and guide you through setup, configuration, and ongoing maintenance. Sections: Task Severity Levels, Common Task Types, Completing Tasks #### [Dependencies](https://docs.start9.com/start-os/dependencies.html) Dependencies are other services that a service requires or can optionally integrate with. They are listed on the service details page. Sections: Required vs Optional, What Happens Automatically, Configuring Dependencies, Service Communication #### [Accessing Service Containers](https://docs.start9.com/start-os/service-containers.html) Every service on StartOS runs inside its own isolated LXC container. Within each LXC container, the service runs in one or more subcontainers. StartOS provides start-cli package attach to open a shell inside a service's subcontainer — this is the supported way to access containers. StartOS does not use Docker or Podman; standard container tooling will not work. See the CLI Reference for the full list of start-cli options. > Accessing a service container is an advanced operation. Modifying files, stopping processes, or changing configuration inside the container can break the service or cause data loss. Proceed with caution. Sections: Why Access a Service Container?, Usage, Accessing the LXC Container, Service Data on the Host ### Connecting #### [Local Access](https://docs.start9.com/start-os/lan.html) Connect to your server over your local network using its mDNS address, direct IP address, or private domain. This is the fastest connection method, as traffic stays entirely on your LAN and never reaches the Internet. You must be connected to the same Local Area Network (LAN) as your server, and you must trust your Root CA. The StartOS dashboard is available at the base address (e.g. my-cool-server.local), while installed services are available on different ports of that same address. Sections: Watch the Video, mDNS, IP Address, and Private Domains, Tunnels Do Not Work Locally #### [Remote Access](https://docs.start9.com/start-os/remote-access.html) Remote connections let you reach your server from outside your local network — when traveling, at work, or on any other network. StartOS supports several strategies for remote access, each with different tradeoffs for speed, privacy, and setup complexity. These strategies will not work from the same LAN as your server; for that, see Local Access. Sections: VPN, Tor, and Clearnet #### [Private Access](https://docs.start9.com/start-os/private-access.html) Private connections keep your services accessible only to you and your authorized devices — nothing is exposed to the public Internet. Most people will use private connections for most of their services most of the time. Unless you are intentionally hosting something for others (a website, a blog, a Lightning node), your services should be privately accessible only to you and your trusted devices. Sections: LAN, VPN, and Tor, Common Combinations #### [Public Access](https://docs.start9.com/start-os/public-access.html) Public connections make your services reachable by anyone on the Internet, not just your own devices. This is for services you intentionally want to share — a personal website, a Nostr relay, a Lightning node, or a Nextcloud instance for your family. If only you and your own devices need access, use private connections instead. > If your ISP uses CGNAT, your router cannot accept inbound connections. Clearnet hosting and public IP access require a StartTunnel gateway. Tor works regardless of CGNAT. Sections: Clearnet, Tor, and Public IP, Clearnet and Tor Together #### [Networking Strategy](https://docs.start9.com/start-os/networking-strategy.html) StartOS supports multiple networking strategies that can be used alone or in combination. Choosing the right one depends on your goals — but first, it helps to separate three concepts that are often conflated: security, privacy, and censorship resistance. These are independent properties, and each networking strategy offers a different mix of them. Sections: Security, Privacy, and Censorship Resistance, Common Misconceptions, Choosing a Strategy, Example Setups ### Networking #### [mDNS](https://docs.start9.com/start-os/mdns.html) Multicast DNS (mDNS) gives your server a .local address on your LAN. The address is your server name with .local on the end: a server named my-cool-server gets the mDNS address my-cool-server.local. Sections: Watch The Video, How It Works, Limitations #### [Inbound VPN](https://docs.start9.com/start-os/inbound-vpn.html) Access your server privately from anywhere in the world using a VPN. Only authorized devices can reach your server and its installed services. Think of your server's gateway as a defense perimeter with hundreds of locked doors, each door leading to a unique service interface. One door might say "Vaultwarden UI", another "Bitcoin RPC", and another "Bitcoin P2P". An inbound VPN gives authorized devices a key to the doors they need — without opening them to the public Internet. Sections: WATCH THE VIDEO, LAN IP and Private Domains over VPN, Option 1: Router, Option 2: StartTunnel, Connecting Clients (WireGuard), Connecting Clients (OpenVPN) #### [Outbound VPN](https://docs.start9.com/start-os/outbound-vpn.html) Route your server's outbound Internet traffic through a VPN for privacy. An outbound VPN is like sending your mail through a proxy — the recipient sees the proxy's return address, not yours. Common reasons to use one: - Hide your IP address from external services your server connects to. - Prevent ISP monitoring of your server's traffic. - Route sensitive services differently — for example, send Bitcoin traffic through Mullvad while leaving everything else on the default gateway. Sections: Add a VPN Gateway, Set System-Wide Default Gateway, Leak prevention, Route Individual Services Through VPN #### [Tor](https://docs.start9.com/start-os/tor.html) Access your server over the Tor network using .onion addresses. Tor provides anonymous, censorship-resistant connections. How you use an onion address determines whether it functions as private or public access: keep the address secret and it's a private tunnel; publish it without associating your identity and you host anonymously; publish it with your identity and you host an identified but censorship-resistant service. Sections: WATCH THE VIDEO, Setting Up Tor, Creating and Deleting Onion Services, HTTP vs HTTPS (SSL), Connecting over Tor, Public Hosting #### [Clearnet](https://docs.start9.com/start-os/clearnet.html) Make your services publicly reachable on the Internet using standard domains (.com, .net, etc.). This requires gateway selection, a domain name, DNS configuration, and port forwarding. Sections: WATCH THE VIDEO, Home Router vs Virtual Private Router, Add a Public Domain, Set Up DNS Records, Configure Port Forwarding #### [Public IP](https://docs.start9.com/start-os/public-ip.html) Access a service interface directly using a gateway's public IP address and port number, without a domain name. Some protocols — such as Bitcoin P2P, Lightning, and other peer-to-peer services — communicate using raw IP addresses and ports rather than domain names. For these services, a public IP address may be all that's needed. For hosting websites or APIs that people access in a browser, use a public domain instead. Public IPs accessed in a browser will display certificate warnings because Let's Encrypt does not sign certificates for IP addresses. Visitors would need to trust your Root CA, which is not reasonable for public access. > A public IP address reaches your server from the Internet. If your server is behind a NAT router, typing that address from a device on the same network as the server produces a certificate warning: the router rewrites the connection to your server's LAN address, so your server sees a local connection and presents the certificate for that address instead. Use its .local address, a private domain, or its LAN IP from inside your own network. A server that holds its public address directly, or that you reach over StartTunnel, is unaffected. Sections: Watch The Video, Enable Public IP Access, Home IP Address Stability, Configure Port Forwarding #### [Gateways](https://docs.start9.com/start-os/gateways.html) A gateway is a network interface that connects your server to the Internet. Your router is the default gateway — it is always present. You can add additional gateways using WireGuard configuration files. All gateways are managed under System > Gateways. Sections: WATCH THE VIDEO, Gateway Types, Adding a Gateway, Updating a Gateway's Config, Secure Gateways #### [Private Domains](https://docs.start9.com/start-os/private-domains.html) A private domain works like your server's mDNS address, except it also works over VPN and it can be anything. It can be a real domain you control, a made up domain, or even a domain controlled by someone else. Private domains can be added to any gateway: wired (Ethernet), wireless (WiFi), or WireGuard (StartTunnel). They can only be accessed when connected to the same network as your server — your LAN, or a VPN / tunnel — and they require trusting your server's Root CA. Sections: Adding a Private Domain, DNS for Private Domains, Split DNS: the Same Domain, Public and Private #### [DNS](https://docs.start9.com/start-os/dns.html) This page covers how StartOS resolves domain names and when you might need to change the defaults. Sections: WATCH THE VIDEO, DHCP, Static DNS Servers, Private Domains #### [CGNAT (Carrier-Grade NAT)](https://docs.start9.com/start-os/cgnat.html) CGNAT is a networking technique where your ISP places your home network behind an additional layer of NAT that you do not control. This page explains what CGNAT is, how to tell if you're behind it, and what it means for self-hosting on StartOS. Sections: Watch The Video, What Is CGNAT?, Who Is Affected?, Impact on StartOS, The Solution: StartTunnel, How to Check ### Backups #### [Creating Backups](https://docs.start9.com/start-os/backup-create.html) Back up your server's data to a physical drive or a network folder. > Creating backups is an essential responsibility of self-hosting. If you do not make backups, you will eventually lose your data. Sections: Watch The Video, Important Info, Best Practices, Physical Drive, Network Folder #### [Restoring Backups](https://docs.start9.com/start-os/backup-restore.html) Restore previously created backups to recover individual services or your entire server. This is for disaster recovery when a service is accidentally uninstalled or when your data drive is lost or corrupted. Sections: Restoring Individual Services, Restoring an Entire Server ### System #### [Logs](https://docs.start9.com/start-os/logs.html) Every service, and StartOS itself, streams its logs live in the web interface. You can read them there, scroll back through older entries, and download a copy to keep or send to support. Nothing needs to be installed, and you do not need SSH or the command line. Sections: Service Logs, OS and Kernel Logs, Reading a Log, Downloading Logs, From the Command Line #### [Server Name](https://docs.start9.com/start-os/server-name.html) Your server name is its mDNS address without the .local on the end. A server named my-cool-server answers to my-cool-server.local on your local network, and every installed service is reachable at that address too. The name also shows in your browser tab, names the app if you install the UI to a home screen or desktop, and is what the server calls itself over SSH and in its own logs. You choose the name during initial setup, and you can change it at any time under System > General Settings > Server Name. A name may contain lowercase letters, numbers, and hyphens, and may be up to 32 characters long. It cannot start or end with a hyphen. > If you are currently connected via your mDNS address, changing the server name will require you to switch to the new address. You will be prompted with the new address after saving. Installed services move to the new address once the server restarts. An app you have already installed may keep the name it was installed with. Remove it and install it again to pick up a new one. #### [SSH](https://docs.start9.com/start-os/ssh.html) SSH opens a command-line session on your StartOS server from a terminal on your computer. Once connected, commands entered in that terminal run on the server. > Accessing your server via SSH is considered advanced. Please use caution, you can cause permanent damage to your server, potentially resulting in loss of data. Sections: Watch The Video, User and privileges, Connect with your StartOS master password, Connect with an SSH key #### [SMTP](https://docs.start9.com/start-os/smtp.html) Configure StartOS with third-party SMTP credentials so that services like NextCloud, Vaultwarden, and Gitea can send email notifications. SMTP is configured under System > SMTP. > This guide is not for using StartOS as an email server. It is for granting StartOS the simple ability to send emails through a 3rd party SMTP server. Sections: Getting SMTP Credentials, Configuring StartOS #### [WiFi](https://docs.start9.com/start-os/wifi.html) StartOS supports connecting your server to a wireless network when a wired Ethernet connection is not available. WiFi is managed from System > WiFi. > A wired Ethernet connection provides significantly better reliability, throughput, and latency. WiFi is prone to intermittent drops that can interrupt backups, corrupt data transfers, and degrade service performance. Only use WiFi if Ethernet is truly not an option. Sections: Requirements, Enabling WiFi, Connecting to a network, Adding a hidden network, Fix WiFi Connection Issues #### [Internationalization](https://docs.start9.com/start-os/internationalization.html) StartOS supports multiple languages and keyboard layouts. Sections: Language, Keyboard Layout #### [Kiosk Mode](https://docs.start9.com/start-os/kiosk-mode.html) Kiosk Mode runs a full Firefox browser on your server and displays the StartOS dashboard on a directly connected monitor. It is intended for debugging and initial setup when no other client device is available. > StartOS servers are designed to run headless. Kiosk Mode consumes at least 1 GB of RAM running Firefox. Unless you specifically need it for troubleshooting, leave it disabled. Sections: Enabling Kiosk Mode, Disabling Kiosk Mode, Changing Keyboard Layout #### [Updating StartOS](https://docs.start9.com/start-os/updating-startos.html) > There are no automatic updates in StartOS. Updating the operating system and service always requires explicit action. That said, we highly recommended keeping StartOS up to date for the latest security and performance patches, as well as to take advantage of new features. Sections: Update through the UI, Update by Re-flashing #### [Changing Your Password](https://docs.start9.com/start-os/change-password.html) To change your StartOS master password, go to System > Change Password in the main UI and enter a new password. You do not need to enter your current password — being signed in is sufficient. > Existing backups remain encrypted with the password that was set when they were created. Changing your password does not re-encrypt them, so keep your old password until you no longer need those backups. #### [Forgot Password](https://docs.start9.com/start-os/forgot-password.html) If you have lost or forgotten your StartOS master password, there are two ways to reset it. Sections: From a signed-in device, By reinstalling ### Reference #### [start-cli Reference](https://docs.start9.com/start-os/cli-reference.html) The primary CLI for managing a StartOS server. Connect via SSH to run commands locally, or use --host to manage a server remotely. Pass -h at any level to see subcommands and options. Service developers will find the S9PK Packaging and Registry sections especially useful. The tunnel subcommand group is documented separately in the StartTunnel CLI Reference. Sections: Global Options, Authentication, Server, Services, Backups, Networking, SSH Keys, WiFi, Notifications, Kiosk Mode, Disks, Diagnostics, Database, S9PK Packaging, Registry, Initial Setup, Utilities #### [Architecture](https://docs.start9.com/start-os/architecture.html) StartOS is a Linux distribution purpose-built for running a personal server. Unlike general-purpose operating systems designed for desktops and laptops, StartOS provides a graphical interface for discovering, installing, configuring, and managing self-hosted services — no command line required. This page describes how StartOS is designed and how its components fit together. For implementation details, see the start-os repository. Sections: Components, Service Model, Networking, State Management, Security, Tech Stack, Source Code #### [FAQ](https://docs.start9.com/start-os/faq.html) Common issues encountered during setup and daily use of StartOS, including a USB installer that will not boot, network connectivity problems, diagnostic mode, clock sync failures, domains that do not resolve, running out of storage, running two copies of a service, and service-specific troubleshooting. Sections: Do I need a surge protector for my server?, I do not have access to Ethernet, StartOS boots into "Diagnostic Mode", My server boots into StartOS instead of the USB installer, During initial setup, I am unable to connect to "start.local"., I am unable to connect to my server's "server-name.local" URL, I am unable to reach a service at its domain name, A public domain still loads after disabling it, Clock Sync Failure, "Gateway Timeout" in the StartOS UI, Can I add a second drive to give a service more storage?, Can I run two copies of the same service?, Issue with a particular service ### Start9 Hardware #### [Start9 Hardware](https://docs.start9.com/start-os/start9-hardware.html) Every server Start9 has sold, newest first: the Server One (6600H) — the only server sold today — the Server One (2026), Server Pure (2026), Server Pure (2025), Server One (2024), Server One (2023), Server Pure (2023, sold earlier as the Embassy Pro and Server Pro), and the Raspberry Pi 4 based Embassy, Embassy One and Server Lite. Each entry lists the specifications, how to tell that model from its neighbours, and whether its memory and storage can be upgraded. What is for sale now is at store.start9.com. For the router, see Hardware in the StartWRT documentation. For hardware Start9 did not sell, see the community known-good hardware list. Sections: Server One (6600H), Server One (2026), Server Pure (2026), Server Pure (2025), Server One (2024), Server One (2023), Server Pure (2023), Embassy, Embassy One and Server Lite #### [Flashing Firmware - Server Pure](https://docs.start9.com/start-os/firmware-pure.html) This page is for the Server Pure only — the 2023, 2025 and 2026 models. It will not work on other devices. Generally, you do not need to manually flash your device using this guide, as the firmware is now automatically updated on supported devices. Please only use this method if directed by a Start9 Support Technician. If you were told to "flash your device", you are looking for Installing StartOS instead. Sections: Required Equipment, Firmware Flashing Steps #### [Flashing Firmware - Server One (2023)](https://docs.start9.com/start-os/firmware-one-2023.html) Start9's 2023 Server One was the Intel NUC11ATKC4, whose BIOS was refered to as "ATJSLCPX" by Intel, and whose latest release was AT0043.cap before they officially discontinued support for the product line. This page updates the BIOS of the Server One (2023) only. If you were told to "flash your device", you are looking for Installing StartOS instead. > The BIOS capsule linked below is Intel's, not Start9's — Copyright (c) Intel > Corporation, all rights reserved, and subject to Intel's own firmware license. > We mirror it unmodified because Intel withdrew it when the product line was > discontinued. It is not covered by StartOS's MIT license. Sections: Required Equipment, BIOS Update Steps ## StartTunnel ### Getting Started #### [Installing](https://docs.start9.com/start-tunnel/installing.html) Install StartTunnel on a Debian VPS by renting a server, running the one-line installer script, and initializing the web interface. The entire process takes just a few minutes. Sections: Watch The Video, Prerequisites, Get a VPS, Connect to your VPS, Run the installer, Initialize the web interface, Next steps ### User Manual #### [Subnets](https://docs.start9.com/start-tunnel/subnets.html) A subnet is an isolated private network (a VLAN) whose devices can all communicate with each other. By default a subnet is a /24 (254 devices), but the range is configurable: you can give it a larger block (a smaller prefix, e.g. /16) for more devices. /24 is the smallest allowed — StartTunnel rejects a range smaller than /24. StartTunnel comes with a default subnet, which is sufficient for most users. You can create additional subnets to isolate groups of devices from each other. Sections: Creating a Subnet, DNS, Outbound IP, IPv6, Removing a Subnet #### [Devices](https://docs.start9.com/start-tunnel/devices.html) Every device on a StartTunnel subnet gets its own WireGuard configuration. Devices come in two kinds, listed in separate tables on the Devices page: - Servers — a StartOS server that may configure the gateway on its own behalf: injecting DNS records for its private domains and auto-publishing ports (via PCP/UPnP). Both capabilities are on by default for a Server. - Clients — a plain peer such as a phone or laptop that uses the tunnel for connectivity only, with no gateway-configuration abilities. Sections: Adding a Device, Server capabilities, Changing a device's role, Outbound IP, IPv6, Removing a Device #### [Published Ports](https://docs.start9.com/start-tunnel/published-ports.html) Publishing a port exposes a device's port to the public Internet. StartTunnel can do this over IPv4 (a DNAT from your VPS's public IPv4) and over IPv6 (a firewall pinhole on the device's own global address) — one dialog handles both. > IPv4 publishing requires a dedicated public IPv4 address on your VPS. Shared IPv4 addresses (CGNAT, shared NAT, load-balanced IPs) cannot be used to expose services to the clearnet. IPv6 publishing instead needs a routed IPv6 prefix delegated to the subnet (see IPv6); each device then has its own globally-routable address, so a dedicated public IPv4 isn't required for the IPv6 path. > StartTunnel acts as a port-control gateway for connected devices, speaking PCP (preferred) and UPnP. A StartOS server using this tunnel opens the ports it needs automatically — over IPv4 and, on a current StartOS (0.4.0-beta.10+) with an IPv6 prefix, over IPv6 too — when you enable a public address, and removes them when the address is disabled or deleted. Each automatic PCP mapping carries a lease that the device renews while it still wants the port; if the device stops renewing (it goes offline, or you withdraw the exposure), the tunnel drops the published port on its own rather than letting it linger. For security, an automatically published port or pinhole always targets the requesting device's own address; a device can only publish ports to itself. The steps below are for adding or managing published ports manually. Sections: IPv4 published ports vs. IPv6 pinholes, Manual and automatic ports, Add a port manually, SNI hostnames (IPv4 only) #### [HTTP Redirects](https://docs.start9.com/start-tunnel/http-redirects.html) StartTunnel runs an HTTP→HTTPS redirect on port 80 of every public IPv4 address your VPS holds. A plain http:// request to one of these addresses is answered with a redirect to the same host over https://, so visitors who leave off the scheme still land on your TLS service instead of getting a connection error. These redirects are on by default — on a fresh install and after an update, every public IPv4 gets one automatically. You can turn any of them off, and your choice persists. Sections: Where they run, Mutually exclusive with a published port 80, Managing them in the UI, Managing them from the CLI #### [IPv6](https://docs.start9.com/start-tunnel/ipv6.html) StartTunnel can give the devices on a subnet a real, globally-routable IPv6 address drawn from a prefix your VPS delegates. IPv6 is configured per subnet — each subnet can point at its own prefix (or none). This is optional and off by default; IPv4 published ports work without it. Sections: What your VPS provides, Requirements, Configuring a subnet's prefix, Verifying it works, How addresses are assigned, Routing, DNS #### [IPv4](https://docs.start9.com/start-tunnel/ipv4.html) StartTunnel uses your VPS's public IPv4 addresses for clearnet hosting and outbound traffic. The one dedicated address required at install time is all most users need — this page covers adding more. Each additional address is a full, independent public identity with its own port space. Sections: Why add an address, Getting an address onto your VPS, Using it in StartTunnel, Verifying #### [DNS Records](https://docs.start9.com/start-tunnel/dns-records.html) StartTunnel runs a private DNS resolver for your tunnel. It lets you reach the services you host on tunnel devices by a memorable hostname — e.g. home.example.com or git.lan — instead of memorizing each device's tunnel IP. These names are private to your tunnel: they resolve for connected devices only, and are never published to the public Internet. Sections: Why use it, How it works, Allowing a device to inject records, Viewing and managing records #### [Updating](https://docs.start9.com/start-tunnel/updating.html) Keep StartTunnel up to date using the web UI, CLI, or install script. Run the CLI and install script on your VPS as root. Sections: Web UI, CLI, Install script #### [Uninstalling](https://docs.start9.com/start-tunnel/uninstalling.html) StartTunnel is designed to run on a dedicated VPS. To remove it, simply destroy the VPS through your hosting provider. All WireGuard keys and configuration are stored on the VPS and will be removed with it. ### Reference #### [start-tunnel CLI Reference](https://docs.start9.com/start-tunnel/cli-reference.html) The start-tunnel CLI manages a StartTunnel server — a WireGuard-based gateway that provides clearnet access to devices behind NAT. Run it as root directly on the StartTunnel server, or use start-cli tunnel to manage it remotely from a StartOS server. Sections: Global Options, Authentication, Subnets, Devices, Port Forwarding, HTTP Redirects, IPv6 Pinholes, Updates, Server Management, Web Interface, Database #### [StartTunnel](https://docs.start9.com/start-tunnel/architecture.html) StartTunnel is a virtual private router (VPR) — a minimal, self-hosted router that runs on a VPS instead of sitting in your house. Just like a home router, it creates private networks, assigns IP addresses to devices, and forwards ports to the public Internet. The difference is that it exists in the cloud, so it works regardless of your home network's limitations. - Clearnet hosting like Cloudflare Tunnels, but you control the router - Private access like Tailscale, but fully self-hosted - Dead simple — one command to install, manage everything from the CLI or web UI - Open source — audit it, fork it, own it > For setup instructions, see Installing. Sections: Features, How StartTunnel Compares, Security, Requirements, Source Code #### [FAQ](https://docs.start9.com/start-tunnel/faq.html) Answers to common questions about StartTunnel's security model, compatibility, VPS requirements, and what happens if Start9 goes away. Sections: Can anyone else see my traffic?, Do I need a WireGuard client on my devices?, Why can't my Android phone resolve `.local` addresses while the tunnel is on?, Can I run other services on the same VPS?, Does StartTunnel work behind CGNAT?, What if I forget my password?, What if Start9 goes away?, How do I remove StartTunnel?, What VPS providers work with StartTunnel?, The installer says "No internet connectivity detected", but my network works, Does StartTunnel work on an IPv6-only VPS?, Does StartTunnel provide DDoS protection? ## Service Packaging ### Getting Started #### [Environment Setup](https://docs.start9.com/packaging/environment-setup.html) Before building service packages, you need to install several development tools on your workstation. This page lists each prerequisite and how to install it. The final section — Set Up Your Packaging Workspace — scaffolds the AI-assisted workspace that all packaging is designed around. > The Linux examples below install packages with apt, for Debian-based distros (Debian, Ubuntu, Mint, PopOS, …). On another distro, use your package manager to install the same packages. Sections: StartOS Device, Docker, Make, Node.js v22 (Latest LTS), cURL, Start CLI, Git, jq, Verification, Set Up Your Packaging Workspace #### [Quick Start](https://docs.start9.com/packaging/quick-start.html) This guide walks you through scaffolding a new service package, building it, and installing it on StartOS. The scaffold is a working Hello World service — your starting point for packaging any app. > Complete Environment Setup first — including creating your packaging workspace. start-cli s9pk init-package only runs inside a workspace. Sections: Scaffold the Package, Install to StartOS, Next Steps #### [New Package Checklist](https://docs.start9.com/packaging/new-package-checklist.html) start-cli s9pk init-package "" scaffolds a barebones clone — one daemon running the hello-world image with a port-listening health check, no interface, no dependencies. This page takes that clone to a release-ready package. Work it top to bottom. The scaffold names its arbitrary ids example-* (example-volume, example-image, example-daemon) to signal that you rename them freely; they are not required namings. > Wrapping an existing upstream Docker image — the common case? Read > Package a Prebuilt Docker Image first. It expands the > "replace the hello-world image" step below. Sections: Identity & metadata, The service, Docs, Build, test, ship, After that #### [Development Workflow](https://docs.start9.com/packaging/workflow.html) This page covers how to behave while working on a package — the disciplines that apply to every change, no matter which SDK constructs you touch. The rest of the guide describes what to build; this page describes how to work while building it. These rules are the canonical home for the working discipline an AI coding agent should follow on every change. Sections: Keep README and instructions in sync, Iterate with a dirty working tree, Pre-existing errors are still errors, Work one package at a time, Verify against reality, not against `tsc`, Don't fabricate — verify or flag, Fix what you find; file only what needs deciding, Search the SDK before deciding something is impossible, A comment is not evidence, Read the monorepo source only when the guide can't answer, Don't create unnecessary version files #### [Maintaining a Package](https://docs.start9.com/packaging/maintaining-a-package.html) The rest of this guide is about making a change: which construct to reach for, how to write it, how to verify it. This page is about the package as something that keeps existing — the branches it accumulates, the upstream it chases, and the sibling packages it depends on. None of it matters much on the day you scaffold a package, and all of it matters by the fiftieth release. Sections: Branches, Parallel release lines, Chasing upstream, Bumping the SDK, Depending on another package's repo #### [StartOS Packaging — Agent Context](https://docs.start9.com/packaging/agent-context.html) > This page is the AGENTS.md that start-cli s9pk init-workspace links into every packaging workspace. Your workspace copy is a symlink to this file, so syncing the guide keeps it current. You are an AI assistant working in a StartOS packaging workspace. You help create, maintain, and update .s9pk service packages for StartOS. This file is your always-on context: the rules to follow, the patterns to know, and a map of where to read for any given objective. The substance lives in the packaging guide under start-technologies/projects/start-sdk/docs/ — read those pages locally, on demand, as the work requires. Do not load everything at once. Sections: Workspace layout, Keeping the workspace current, How to use the guide (local-first), Skills, Where to read for X, Reading the SDK and OS source (last resort), Key patterns, Golden rules, Working discipline (every change), Starting a new package ### Recipes #### [Recipes](https://docs.start9.com/packaging/recipes.html) This is the primary entry point for StartOS service packaging — for both you and your AI coding agent. Each recipe describes a common packaging pattern, names the SDK constructs involved, links to reference pages for API details, and points to real packages for working code. Your agent reads these to understand what to build; you read them to understand what to ask for. If you're using Claude Code (recommended), point your agent at the recipe for your objective and let it follow the reference and package links from there. > Starting a brand-new package? Scaffold it first with start-cli s9pk init-package "My Service", then work the New Package Checklist from top to bottom — don't hand-assemble files by copying another package. If you're wrapping an existing upstream Docker image (the common case), read Package a Prebuilt Docker Image before you start. Sections: Configuration, Credentials & Access Control, Setup & Lifecycle, Daemons & Containers, Networking, Dependencies, Data & Health, User Communication #### [Set Up a Basic Service](https://docs.start9.com/packaging/recipe-basic-service.html) A minimal StartOS service: one container, one web UI, one health check, one backup volume. This is the starting point for any new package — every other recipe builds on this foundation. Sections: Solution, Examples #### [Package a Prebuilt Docker Image](https://docs.start9.com/packaging/recipe-prebuilt-image.html) The most common packaging task is wrapping an existing upstream Docker image — linuxserver/*, an official org/app image, a community image — rather than building your own from a Dockerfile. It looks simple, and the happy path is. But the same handful of mistakes sink these packages over and over: the image name is guessed instead of verified, only one of the image's data paths gets mounted, non-UI ports are forgotten, an image with its own init system crashes because it isn't PID 1, and credentials are "set" by hand-editing a config format that was never confirmed. This recipe is the checklist that keeps those from happening. This page assumes the service shape from Set Up a Basic Service — daemon, interface, health check, backup — and covers only what's different when you don't control the image. If you're starting a brand-new package, scaffold first (start-cli s9pk init-package "My Service") and work the New Package Checklist top to bottom; this recipe expands the "replace the hello-world image" line of that checklist. Sections: Solution, Verify the image, Mount all data paths, Images with their own init system, Credentials, Examples, Checklist #### [Create Configuration Actions](https://docs.start9.com/packaging/recipe-config-actions.html) Many services need user-configurable settings — log levels, feature toggles, resource limits. On StartOS, these are presented as actions with input forms. The user fills out the form, and the handler writes the values to a file model. Sections: Solution, Examples #### [Generate Config Files](https://docs.start9.com/packaging/recipe-config-files.html) Most services read their configuration from files (YAML, TOML, INI, JSON, ENV). StartOS file models let you define the file's schema in zod, then read and write it type-safely. The schema doubles as the source of truth for defaults — use .catch() on every field so files self-heal and merge() works correctly. Sections: Solution, Examples #### [Pass Config via Environment Variables](https://docs.start9.com/packaging/recipe-env-vars.html) Some services expect configuration through environment variables rather than config files. StartOS lets you set them in the daemon's exec.env object, with values sourced from file models, store.json, or hardcoded strings. Sections: Solution, Examples #### [Hardcode Config Values](https://docs.start9.com/packaging/recipe-hardcode-config.html) Some settings must be fixed for the service to work on StartOS — ports, data paths, bind addresses, auth modes. Use z.literal().catch() in your file model schema to enforce these values. Any manual edit or stale config is automatically corrected on the next read. Sections: Solution, Examples #### [Set a Primary URL](https://docs.start9.com/packaging/recipe-primary-url.html) Some services need to know which URL they're hosted at — for generating links, sending invites, federating with other servers, or embedding in emails. Since StartOS services can be reached via multiple addresses (LAN, Tor, clearnet), the user must choose which URL the service treats as primary. Sections: Solution, Examples #### [Set Up SMTP / Email](https://docs.start9.com/packaging/recipe-smtp.html) Services that send email (notifications, password resets, invites) need SMTP configuration. The standard StartOS pattern offers three modes: disabled (no email), system (uses the StartOS system SMTP if configured), and custom (user provides their own SMTP server). The SDK provides built-in constructs for the entire flow. Sections: Solution, Examples #### [Auto-Generate Internal Secrets](https://docs.start9.com/packaging/recipe-internal-secrets.html) Many services need passwords or tokens that are generated once and used internally — database passwords, API secret keys, inter-container auth tokens. These are never shown to the user. Generate them at install time and store them in store.json for later consumption. Sections: Solution, Examples #### [Prompt User to Create Admin Credentials](https://docs.start9.com/packaging/recipe-admin-credentials.html) Most services need admin credentials before the user can sign in. The standard pattern pairs a setupOnInit watcher with a setAdminPassword action: the watcher surfaces a critical task when no password is stored, and the action — when the user runs it — generates, stores, and returns the credential. The same action handles later rotation. Sections: Solution, Confirm before rotating, Never roll your own password RNG, Examples #### [Reset a Password](https://docs.start9.com/packaging/recipe-reset-password.html) When users lose their admin password, they need a way to generate a new one. A reset action creates a temporary subcontainer, runs the app's password-reset command, and returns the new credentials. This works whether the service is running or stopped, depending on the app. Sections: Solution, Examples #### [Gate User Registration](https://docs.start9.com/packaging/recipe-registration-gating.html) Multi-user services often need registration enabled briefly (for the admin to create their account) then disabled to prevent unauthorized signups. A toggle action flips the setting and dynamically updates its own label to reflect the current state — "Enable Signups" vs "Disable Signups." Sections: Solution, Examples #### [Require Setup Before Starting](https://docs.start9.com/packaging/recipe-require-setup.html) Some services need the user to complete a step before the service can start — choosing a backend, setting a permanent hostname, entering API credentials. A critical task with a hidden action blocks startup until the user acts. Sections: Solution, Examples #### [Run One-Time Setup on Install](https://docs.start9.com/packaging/recipe-install-init.html) Fresh installs often need one-time bootstrapping — generating passwords, seeding config file defaults, creating initial database records. The setupOnInit hook receives a kind parameter that tells you why initialization is running. Sections: Solution, Examples #### [Bootstrap via Temporary Daemon Chain](https://docs.start9.com/packaging/recipe-run-until-success.html) Some services can only be configured through their own API — they have no CLI for initial setup. During install, you need to start the service temporarily, call its API to bootstrap (create admin users, set config, register apps), then shut everything down before normal startup. The runUntilSuccess pattern handles this. Sections: Solution, Examples #### [Handle Version Upgrades](https://docs.start9.com/packaging/recipe-version-migrations.html) When you release a new version of your package, users upgrading from older versions may need data migrations — transforming config formats, moving files, or updating store schemas. The version graph defines the migration path between versions. This is the mechanism for anything keyed to the package version — the data on disk was written by an older release and the new one cannot read it as-is. It runs once per install, covers restoring a backup taken below the current version, and never runs on a fresh install. Work whose answer can differ on the next start belongs in a oneshot instead; see main.md § Choosing Between a Oneshot, an Init, and a Migration. Sections: Solution, Examples #### [Handle Restore from Backup](https://docs.start9.com/packaging/recipe-restore-init.html) After restoring from backup, a service may need to re-register with external systems, fix file paths, or regenerate ephemeral state. The setupOnInit hook receives kind === 'restore' in this case — distinct from 'install' (fresh) and null (rebuild). Sections: Solution, Examples #### [Run Multiple Containers](https://docs.start9.com/packaging/recipe-multi-daemon.html) Complex services often need multiple processes — an application server plus a database, a web frontend plus a backend API, or an app plus a cache layer. Each container gets its own subcontainer, daemon definition, health check, and dependency chain. Sections: Solution, Examples #### [Run a PostgreSQL Sidecar](https://docs.start9.com/packaging/recipe-postgresql.html) PostgreSQL is the most common database sidecar in StartOS packages. The pattern covers password generation in init, the daemon definition with health check, and backup/restore using the SDK's built-in pg_dump support. Sections: Solution, Examples #### [Run a MySQL/MariaDB Sidecar](https://docs.start9.com/packaging/recipe-mysql.html) Some upstream services require MySQL or MariaDB instead of PostgreSQL. Each engine has its own health checks, lifecycle tools, and dump-based backup builder. Sections: Solution, Examples #### [Run a Redis/Valkey Cache](https://docs.start9.com/packaging/recipe-valkey.html) Caching layers improve performance for web applications. Valkey (Redis-compatible) runs as a sidecar daemon with no persistent storage — purely ephemeral. Sections: Solution, Examples #### [Create Dynamic Daemons](https://docs.start9.com/packaging/recipe-dynamic-daemons.html) Some services need a variable number of daemons based on user configuration — one per tunnel, one per website, one per connected node. The daemon chain is built at runtime from a config list. Sections: Solution, Examples #### [Run a One-Shot Command](https://docs.start9.com/packaging/recipe-oneshot.html) Before the main daemon starts, you may need to fix file ownership, run the app's own database migrations, or perform other idempotent setup. Oneshots run to completion and block dependent daemons until they finish. A oneshot runs on every start, so it fits work whose answer can differ next time. Work keyed to the package version — relocating or repairing data an older release left behind — belongs in migrations.up instead, even when you can guard it to be idempotent. See main.md § Choosing Between a Oneshot, an Init, and a Migration. Sections: Solution, Examples #### [Run a Nested OCI Runtime](https://docs.start9.com/packaging/recipe-nested-oci-runtime.html) Some services run their own containers — CI runners (gitea-act-runner, Forgejo Runner, Drone) execute every job inside a fresh OCI container; build daemons (buildkitd) launch sandboxes per build; emulator services pull and run arbitrary images on demand. Without a real container engine inside the service, those workloads can't be sandboxed properly and the service can't isolate untrusted user code. StartOS supports running a rootless OCI engine — Podman or Docker — inside an opt-in service. A nested engine needs two manifest flags: userspaceFilesystems: true exposes /dev/fuse for fuse-overlayfs storage, and virtualNetworking: true exposes /dev/net/tun for slirp4netns/pasta networking. The service's own LXC remains userns-mapped and AppArmor-confined; nothing about the host's posture changes. Sections: Solution, Manifest, What StartOS provides, Image: Podman, Image: Docker, Caveats #### [Expose a Web UI](https://docs.start9.com/packaging/recipe-web-ui.html) Every service with a browser interface needs at least one HTTP interface. This is the most basic networking pattern — bind a port, create an interface descriptor, and export it. Sections: Solution, Authentication, Examples #### [Expose Multiple Interfaces](https://docs.start9.com/packaging/recipe-multi-interface.html) Services often need more than a web UI — RPC endpoints, peer-to-peer connections, WebSocket servers, SSH, or admin dashboards on separate ports. Each interface gets its own MultiHost, port binding, and interface descriptor. Sections: Solution, Examples #### [Expose an API-Only Interface](https://docs.start9.com/packaging/recipe-api-interface.html) Some services have no web UI — they expose only a programmatic API (REST, gRPC, or custom protocol). The URL is shown as a copyable connection string rather than a clickable browser link. Sections: Solution, Examples #### [Depend on Another Service](https://docs.start9.com/packaging/recipe-dependency.html) When your service needs another StartOS service (e.g., a Bitcoin node for a wallet, or PostgreSQL from a shared instance), declare it as a dependency. You can require it to be installed, running, or healthy, and declare the versions it accepts. Sections: Solution, Examples #### [Enforce Settings on a Dependency](https://docs.start9.com/packaging/recipe-enforce-dependency.html) Sometimes your service requires specific configuration on a dependency — a Bitcoin node must have txindex=true, or ZMQ must be enabled. A cross-service task fires on the dependency whenever its config drifts from the required values. Sections: Solution, Examples #### [Mount Volumes from Another Service](https://docs.start9.com/packaging/recipe-mount-dependency.html) Some services need read-only access to files from another service — media files from a file manager, TLS certificates from a Lightning node, or shared data directories. Mount a dependency's volume into your container. Sections: Solution, Examples #### [Support Alternative Dependencies](https://docs.start9.com/packaging/recipe-alternative-deps.html) Some services can work with multiple backends — LND or Core Lightning for Lightning, File Browser or Nextcloud for media. An action lets the user choose, and each optional dependency's enabled function reads that choice to activate the selected backend. Sections: Solution, Examples #### [Back Up and Restore Data](https://docs.start9.com/packaging/recipe-backups.html) Every StartOS package must define a backup strategy. The SDK provides builders for common patterns: simple volume snapshots, PostgreSQL dumps, MySQL dumps, MariaDB dumps, and incremental rsync for large datasets. StartOS always runs the backup with the service stopped — when a backup begins it first stops the service if it was running, performs the backup, then restarts it afterward, but only if it had been running. Sections: Solution, Examples #### [Add Standalone Health Checks](https://docs.start9.com/packaging/recipe-health-checks.html) Every daemon already includes a ready check that tells StartOS when it's started. Standalone health checks go beyond that — they monitor ongoing conditions like blockchain sync progress, network reachability, or secondary interface availability. These checks run continuously and are displayed to the user separately from daemon readiness. Sections: Solution, Examples #### [Post a Notification to the User](https://docs.start9.com/packaging/recipe-notification.html) Surface information to the user in the StartOS notifications panel — the same panel where StartOS shows backup-completion notices, install failures, and similar OS-generated events. Use this sparingly, only for information the user genuinely needs to know about — most commonly that a long-running action has finished (a sync health check that finally passes, a lengthy reindex or migration completing). Notifications are not a changelog feed or an activity log. If you need the user to do something, use a Task instead. Sections: Solution, Examples ### Hosting a Registry #### [Hosting a Registry](https://docs.start9.com/packaging/host-registry.html) A registry is the server that hosts, indexes, and distributes .s9pk packages and StartOS updates. Anyone can run one. This chapter covers running your own — from installing the packaged service on a StartOS device through day-to-day administration. StartOS is built around an open registry model: no single entity controls what services are available, and packages can be distributed through any number of independent registries. Running your own makes you a distribution point in that ecosystem — useful for private testing, distributing to a specific audience (friends, customers, an organization), or maintaining packages indefinitely outside Start9's pipeline. Plenty of packages live this way permanently. Sections: What's in this chapter, When you don't need to host your own #### [Setup](https://docs.start9.com/packaging/host-registry-setup.html) The packaged startos-registry service is the supported way to run a registry. Install it from any registry that carries it (the Start9 registry does), complete two first-run actions, and you're ready to publish. Sections: 1. Install the service, 2. Configure Registry, 3. Add the first administrator, 4. Point `start-cli` at the registry, 5. Smoke-test #### [Administration](https://docs.start9.com/packaging/host-registry-administration.html) Day-to-day registry administration happens through start-cli registry from an admin's workstation. This page walks through the common tasks; for full command syntax see the start-cli registry reference. All commands below assume your start-cli is pointed at your registry — either via --registry on each invocation or via a named registry profile in your workspace .startos/config.yaml (used with -r ). See Setup if you haven't configured that yet. Sections: Signers, Packages, Categories, StartOS versions, Inspecting the registry, Low-level database access ### Reference #### [Project Structure](https://docs.start9.com/packaging/project-structure.html) Every StartOS service package follows a standard directory layout. This page documents the purpose of each file and directory in the project. Sections: Root Directory Layout, The Package Repo Is Not a Fork of the Application, Core Files, assets/, startos/ #### [Manifest](https://docs.start9.com/packaging/manifest.html) The manifest defines service identity, metadata, and build configuration. It lives in startos/manifest/ as two files: - index.ts -- the setupManifest() call - i18n.ts -- translated strings for description Sections: manifest/i18n.ts, manifest/index.ts, Required Fields, Pre-download alerts, License, Icon, Images Configuration, Volumes, Dependencies #### [Versions](https://docs.start9.com/packaging/versions.html) StartOS uses Extended Versioning (ExVer) to manage package versions, allowing downstream maintainers to release updates without upstream changes. Sections: Version Format, Choosing a Version, File Structure, Incrementing Versions, Release Notes, Migrations, setupOnInit, Git Tag Conventions #### [Main](https://docs.start9.com/packaging/main.html) setupMain() defines the runtime behavior of your service -- daemons, health checks, volume mounts, environment variables, and config file generation. It runs each time the service is started. Sections: Basic Structure, SubContainers, Reactive vs One-time Reads, Getting Hostnames, Oneshots (Runtime), Exec Command, Environment Variables, Health Checks, Volume Mounts, Writing to Subcontainer Rootfs, Executing Commands in SubContainers, PostgreSQL Sidecar, Config File Generation #### [Initialization](https://docs.start9.com/packaging/init.html) setupOnInit registers a handler that runs when the container initializes — and runs again, from the top, whenever a .const() read inside it sees a new value. An init handler is a live reactive context for the life of the container, the same as setupMain. It is not a script that runs once and exits. Read Init Handlers Are Reactive before writing one. kind identifies the lifecycle event on the first pass of each handler. Reactive re-runs receive null: | Kind | The container came up because | Use For | | ----------- | ----------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | | 'install' | It was freshly installed | Generate internal secrets, seed file-model defaults, create critical tasks for user setup actions, bootstrap via API | | 'update' | The package version changed | Re-apply config, handle post-migration setup | | 'restore' | A backup was restored | Re-establish external state; credentials are already present from the restored store | | null | Container rebuild, server restart, or reactive re-run | The work that has to happen every time, watchers included | Sections: Init Handlers Are Reactive, Init Kinds, Watch State and Prompt (the admin-credentials pattern), Registering a custom init function, runUntilSuccess Pattern, Reporting Init Progress, Common Patterns #### [Interfaces](https://docs.start9.com/packaging/interfaces.html) setupInterfaces() defines the network interfaces your service exposes and how they are made available to the user. This function runs on service install, update, and config save. Sections: Network Reachability, Single Interface, Multiple Interfaces, Conditional exports, bindPort Options, Interface Options, Nominating an Address to Open, Choosing a Primary URL, Port Ranges, Retiring a Host or Binding, TLS Termination, Rewrapping SSL to a TLS container, Serving Your Own TLS (Passthrough), Choosing `secure`, Authenticating at the Proxy #### [Service-to-Service Networking](https://docs.start9.com/packaging/service-to-service.html) Interfaces covers how your service exposes ports inbound. This page covers the reverse: how your service reaches another service at runtime — a wallet dialing Bitcoin's RPC, an indexer dialing Bitcoin's P2P port, anything dialing Tor's SOCKS proxy. For reaching the internet rather than a sibling package, see Outbound Network Access. There is exactly one supported way to do this, and three once-common patterns that are now forbidden. Sections: The host bridge, Reaching a dependency, The Tor exception: always-on flags, State that a config value is derived from, Exposing a bridge-only port, Trusting this server's certificates, Forbidden patterns, Reference implementations #### [Outbound Network Access](https://docs.start9.com/packaging/outbound-networking.html) Interfaces covers traffic inbound to your service. Service-to-Service Networking covers reaching another package. This page covers the third direction: your service reaching the internet. Outbound connections work by default. A service container can open a TCP or UDP connection to any external host — an upstream API, a package registry, a block explorer, an SMTP relay — with no manifest flag and no SDK call. Sections: TLS trust roots are package-scoped, DNS must go through the container's own resolver, Port mapping is reserved to the OS, Don't assume how you are reached #### [Actions](https://docs.start9.com/packaging/actions.html) Actions are user-triggered operations that appear in the StartOS UI for your service. They can display information, accept user input, modify configuration, and more. Sections: Action Without Input, Registering Actions, Result Types, Tasks, Implementation Examples, Action With Input, Conventions, SMTP Configuration #### [Tasks](https://docs.start9.com/packaging/tasks.html) Tasks are notifications that appear in the StartOS UI prompting the user to run a specific action. They are commonly used to surface important information after install or restore, request required configuration, or coordinate setup with dependency services. Sections: Own Tasks, Common Patterns, Dependency Tasks #### [Notifications](https://docs.start9.com/packaging/notifications.html) Notifications are messages your service can post to the StartOS notifications panel — the same panel where StartOS shows backup-completion notices, install failures, and similar OS-generated events. Use them sparingly, only for information the user genuinely needs to know about — most commonly that a long-running action has finished: a sync health check that finally passes, a lengthy reindex or migration completing. They are not a changelog feed or an activity log; the vast majority of what your service does should not produce one. If you need the user to do something, use a Task instead. StartOS attributes every notification to the calling service automatically — a package cannot post notifications on behalf of another package. Sections: Plain Notification, Notification With Markdown Details, Parameters, Common Patterns #### [File Models](https://docs.start9.com/packaging/file-models.html) File Models represent configuration files as TypeScript definitions using zod schemas. They provide type safety, runtime validation, and automatic enforcement of defaults and hardcoded values throughout your codebase. Sections: Supported Formats, Core Principle: Lean on File Models, Creating a File Model, Reading File Models, Writing File Models, Schema Design, Migration Gotchas, Design Guidelines #### [Dependencies](https://docs.start9.com/packaging/dependencies.html) Define a service's dependencies once in startos/dependencies.ts. Each base requirement is packed into the service's manifest and published in its registry metadata. StartOS records required base requirements as current dependencies during initialization; runtime requirements refine them and activate optional integrations. Sections: Declare the Base Requirement, Optional and Conditional Dependencies, Reaching a Dependency #### [Makefile Build System](https://docs.start9.com/packaging/makefile.html) A StartOS package's Makefile carries only project-specific configuration and includes the shared build logic (s9pk.mk) that ships inside the SDK. Sections: File Structure, s9pk.mk, Makefile, Build Commands, Prerequisites, Installation #### [Writing Service READMEs](https://docs.start9.com/packaging/writing-readmes.html) Every StartOS package README documents how your service on StartOS differs from the upstream version. Everything else, a reader can find in the upstream docs. It is also the file that AI agents read to support, operate, and contribute to your package, so its structure is load-bearing in a way an ordinary repository README's is not. Sections: Who reads this file, Guiding principles, Required structure, Table of Contents, Image and Container Runtime, Volume and Data Layout, File Models, Dependencies, Network Access and Interfaces, Installation and First-Run Flow, Actions, Tasks, Health Checks, Backups and Restore, Limitations and Differences, Quick Reference for AI Consumers, Sections, Pre-publish checklist #### [Writing Service Instructions](https://docs.start9.com/packaging/writing-instructions.html) instructions.md is a required file at the root of every StartOS package, alongside README.md. Its contents are packed into the s9pk archive and surfaced to the user under the Instructions tab on the service details page in StartOS. Instructions are written for the human running the service — not for developers, and not a place for the package's internals. AI agents do read this file, but only to learn what the user has been shown: a support agent answers in the terms the user sees here, and an assistant administering the server relies on it to know what the user was walked through. Writing for anyone but the human is what makes it useless to all three. They pick up where the marketplace listing left off: by the time someone reads this tab they have seen the short and long description and clicked Install, so don't reintroduce the service. Orient them to what it does on StartOS, walk them through getting it usefully running, and point them at upstream documentation when they need to go deeper. Sections: Instructions vs. README — they are not the same file, What belongs in instructions, What does not belong in instructions, Style, Suggested structure, Documentation, What you get on StartOS, Getting set up, Using [Service Name], Limitations, Pre-publish checklist #### [Publishing](https://docs.start9.com/packaging/publishing.html) Every .s9pk needs a registry to live in before it can be installed on a StartOS device. StartOS is deliberately flexible about which registry that is — you can run your own forever, submit to the Start9 Community Registry, or do both in parallel. Nothing about the packaging workflow requires you to distribute through Start9. Sections: Self-Hosted Registry, Start9 Community Registry, Pre-Publish Checklist #### [CLI Reference](https://docs.start9.com/packaging/cli.html) The start-cli tool handles both building packages and managing registries. The full command reference lives in the start-cli Reference — these sections are most relevant to service developers: - S9PK Packaging — build, inspect, edit, and publish .s9pk packages - Registry — manage packages, categories, signers, and OS versions on a registry Starting out, the two commands you'll use first are s9pk init-workspace (create a workspace) and s9pk init-package (scaffold a package) — see Environment Setup and Quick Start. ## Bitcoin Guides #### [Archival vs Pruned Nodes](https://docs.start9.com/bitcoin-guides/archival-vs-pruned.html) A Bitcoin node can store the entire blockchain (archival) or only a subset of it (pruned). Both modes fully validate every block and transaction — the difference is how much historical data the node keeps on disk after validation. StartOS supports both modes and includes a feature that makes pruned nodes more capable than they are on other platforms. Sections: Archival Nodes, Pruned Nodes, Pruned Nodes on StartOS, Managing Pruning on StartOS, Which Should You Choose? #### [Electrum Servers](https://docs.start9.com/bitcoin-guides/electrum-servers.html) An Electrum server sits between your Bitcoin node and your wallet, indexing the blockchain so wallets can look up balances, history, and unspent outputs for an address instantly. Most Bitcoin wallets reach a self-hosted node this way rather than over Bitcoin RPC. On StartOS that server is Fulcrum. Once it is installed and synced, see Connecting a Wallet. Sections: Why you need one, Fulcrum, Do you need one at all? #### [Connecting a Wallet](https://docs.start9.com/bitcoin-guides/connecting-wallets.html) Every wallet that talks to your own node needs the same four things: an address, a port, a way to trust your server's certificate, and — if you are away from home — a route in. This page covers all four once, so the per-wallet pages only have to tell you where the settings live. Start here, then look up your wallet in Bitcoin Wallets or Lightning Wallets. Sections: Which connection do you need?, Getting the address, Every address is `ssl://`, Making your wallet trust the certificate, The Electrum desktop wallet, Reaching your server from outside your home, Connecting over Bitcoin RPC instead, When it doesn't connect #### [Bitcoin Wallets](https://docs.start9.com/bitcoin-guides/bitcoin-wallets.html) Bitcoin wallets that can be pointed at your own node — either through an Electrum server such as Fulcrum or directly over Bitcoin RPC. Each entry gives the platforms, the connection method, and where the setting lives in that wallet. Read Connecting a Wallet first: the address, the port, the SSL requirement, and the certificate step are the same for every wallet on this page, and are not repeated in each entry. For Lightning, see Lightning Wallets. Sections: Summary, Apps you run on your own devices, Wallets that run on your server #### [Lightning Wallets](https://docs.start9.com/bitcoin-guides/lightning-wallets.html) Wallets and management tools that drive a Lightning node you run yourself — LND or Core Lightning on StartOS. Some are apps on your phone or laptop; others install onto the server and are reached in a browser. Connecting to a Lightning node is not like connecting to an Electrum server: instead of a host and a port, your node hands you a single URI that already contains its address and a credential. Start with Connecting to your node below, then find your wallet. For on-chain wallets, see Bitcoin Wallets. Sections: Node implementations, Connecting to your node, Summary, Apps you run on your own devices, Tools that run on your server #### [Continuous Backups](https://docs.start9.com/bitcoin-guides/continuous-backups.html) A continuous backup keeps a copy of a service's most volatile data current on storage you choose — Google Drive, Dropbox, a Nextcloud, or any SSH server — so that losing the server never costs you more than the last few seconds. LND and Bark Wallet ship one, because for both a StartOS backup on its own is not enough. Sections: Why a StartOS Backup Is Not Enough, Setting Up, Targets, Restoring #### [Migrating LND to StartOS](https://docs.start9.com/bitcoin-guides/lnd-migration.html) How to transfer your LND node — including on-chain funds and open Lightning channels — from another platform to StartOS without closing channels. > > After migrating your LND wallet to StartOS, never restart your old node. Turning on your old node can broadcast old channel states and result in loss of funds. Sections: Supported Source Platforms, Prerequisites, Migration Steps, Other Platforms, Troubleshooting ## StartWRT ### US Customers #### [Installing the Wi-Fi Module](https://docs.start9.com/start-wrt/wifi-module.html) If you bought a Start9 router in the United States, it arrives as a wired router and gets its Wi-Fi from a small module you install yourself. This guide walks you through installing it safely. It takes about fifteen minutes. Sections: Why Wi-Fi Ships Separately in the US, Which Wi-Fi Modules Work, Before You Start, Installing the Module, If Wi-Fi Doesn't Appear ### Getting Started #### [Installing StartWRT](https://docs.start9.com/start-wrt/installing.html) StartWRT comes pre-installed on Start9 routers. If you need to reinstall or flash a new device, follow the instructions below to create a bootable microSD card and flash the firmware. > StartWRT builds are currently available for RISC-V (riscv64) only — specifically the SpaceMiT K1 SoC used in the BananaPi BPI-F3. Builds for other CPU architectures are not yet available. Sections: Requirements, Download the Image, Write the Image to microSD, Flash the Firmware, DIY and Unprogrammed Boards, Next Steps #### [Initial Setup](https://docs.start9.com/start-wrt/initial-setup.html) After unboxing your Start9 router or completing a fresh install, follow these steps to get up and running. The entire process takes just a few minutes. Sections: Connect to the Router, Create Your Admin Password, Trust Your Root CA, Explore the Web Interface, Next Steps #### [Trusting Your Root CA](https://docs.start9.com/start-wrt/trust-ca.html) In order to establish a secure (HTTPS) connection with your router on the local network, it is necessary to download and trust your router's Root Certificate Authority (Root CA). Your router creates its Root CA during setup and keeps it across updates that preserve its settings. Devices that already trust it remain trusted after such an update. > You must repeat this guide for each device you want to connect to the router's web interface over HTTPS. Sections: Step 1 - Download, Step 2 - Trust, 3. Mozilla Apps (Firefox, Thunderbird, Librewolf) #### [Updating](https://docs.start9.com/start-wrt/updating.html) StartWRT never updates automatically — updating always requires explicit action. There are two ways to update: an in-app update from the web interface (recommended), or a microSD reflash (a fallback if an in-app update ever fails). We highly recommend keeping StartWRT up to date for the latest security and performance patches, as well as to take advantage of new features. Sections: In-App Update (Recommended), Pages Open During an Update, Update by Reflashing (Fallback) ### Core Concepts #### [Security Profiles](https://docs.start9.com/start-wrt/security-profiles.html) Security Profiles are the core concept in StartWRT. Every device on the network is assigned a Security Profile that governs what it can access — LAN devices, the Internet, DNS servers, VPN tunnels, and time-of-day restrictions. Profiles replace the need to manually configure VLANs, firewall zones, subnets, and routing tables. Sections: How Profiles Work, How Devices Get Profiles, Creating a Profile, Editing a Profile, Deleting a Profile, WAN Blackout, Example Profiles #### [Points of Entry](https://docs.start9.com/start-wrt/points-of-entry.html) A point of entry is how a device connects to the StartWRT network and receives its Security Profile. There are three types of entry points, each mapping to a profile. Sections: Ethernet, Wi-Fi, Inbound VPN, Why Entry Points Matter ### Internet #### [WAN Settings](https://docs.start9.com/start-wrt/wan.html) The WAN (Wide Area Network) page configures how the router connects to the Internet through your ISP. Most users will not need to change these settings — StartWRT auto-detects your Internet connection on first boot. Navigate to Internet > WAN Settings. Sections: IPv4, IPv6, DNS, MAC Address, Dynamic DNS #### [Dynamic DNS](https://docs.start9.com/start-wrt/ddns.html) Dynamic DNS (DDNS) maps a stable domain name to your home IP address, even when your ISP changes it. This is essential for remote access features like Inbound VPNs and Published Ports, which require external devices to find your router on the Internet. Sections: Why You Need DDNS, Setting Up DDNS, Checking Your DDNS Status #### [Published Ports](https://docs.start9.com/start-wrt/published-ports.html) Published ports (port forwarding) allow devices on the Internet to reach specific devices on your LAN. Each rule maps a port on the router's public IP address to a port on a device behind the router. Sections: When to Use Port Forwarding, Creating a Rule, Editing a Rule, Enabling and Disabling Rules, Deleting a Rule, Status Indicators, Reaching a Published Port from Your Own Network, Automatic Port Forwarding, Endpoints #### [Outbound VPNs](https://docs.start9.com/start-wrt/outbound-vpn.html) Route your network's Internet traffic through one or more WireGuard VPN providers for privacy. Outbound VPNs hide your home IP address from the services your devices connect to and prevent your ISP from monitoring traffic. Sections: Adding a VPN Client, VPN Chaining, IPv6 and Kill Switch, VPN Detail Page, Enabling and Disabling, Assigning VPNs to Profiles ### Network #### [LAN Settings](https://docs.start9.com/start-wrt/lan.html) The LAN (Local Area Network) page configures the router's internal network addressing. Most users will not need to change these settings — the defaults work for typical home networks. Navigate to Network > LAN Settings. Sections: IPv4, IPv6 #### [Devices](https://docs.start9.com/start-wrt/devices.html) The Devices page shows all devices that have connected to your router, organized into Online (currently connected) and Offline (previously seen) groups. Each device is associated with a Security Profile based on its point of entry. Devices appear here even without an active DHCP lease: devices with static IPs, IPv6-only devices, and devices connected through an external switch (learned from the bridge forwarding table) are all listed. Names are resolved on the router from the device's hostname, with mDNS/Bonjour used as a fallback to recover a friendly name. Some devices never share a name at all — Chromebooks deliberately withhold theirs, and many IoT gadgets can't send one; these are labeled by their operating system (recognized from how they request a network address), e.g. Windows device (3af2b1), or by their hardware vendor, e.g. Apple device (3af2b1), falling back to a generic device-3af2b1 only when nothing identifies them. Assigning your own name always overrides any of these. Sections: Viewing Devices, Device Detail Page ### Points of Entry #### [Ethernet](https://docs.start9.com/start-wrt/ethernet.html) Each physical Ethernet port on the StartWRT router maps to a Security Profile. The port a device plugs into determines its profile — no manual configuration is needed on the device itself. Sections: How It Works, WAN Port, Assigning Profiles to Ports, Changing the WAN Port, Example #### [Wi-Fi](https://docs.start9.com/start-wrt/wifi.html) StartWRT uses a single Wi-Fi network (one SSID) with multiple passwords. Each password maps to a different Security Profile. The password a device uses to connect determines its profile — no manual network selection or VLAN configuration required. Sections: How It Works, The Default Password, Adding a Wi-Fi Password, Editing a Wi-Fi Password, Removing a Wi-Fi Password, Settings, Example #### [Wi-Fi Blackout](https://docs.start9.com/start-wrt/wifi-schedules.html) Wi-Fi Blackout lets you disable the Wi-Fi radio on a recurring timetable. During a blackout window, the radio is powered off entirely — all Wi-Fi devices disconnect regardless of their profile, while Ethernet-connected devices are unaffected. Sections: Use Cases, Setting a Schedule, Removing a Schedule #### [Inbound VPNs](https://docs.start9.com/start-wrt/inbound-vpn.html) Create WireGuard VPN servers on your router for secure remote access to your home network. Each VPN server maps to a Security Profile, so remote devices receive the same access controls as if they were connected locally. Sections: How It Works, Creating a VPN Server, Managing a VPN Server, Managing Clients, Connecting Remote Devices, Removing a VPN Server, Example ### System #### [Settings](https://docs.start9.com/start-wrt/settings.html) The Settings page contains system preferences, account management, and advanced tools. Navigate to System > Settings. The page is organized into tabs: General, Password, SSH Keys, Activity, Logs, Backup, and Advanced. Sections: General, Password, SSH Keys, Activity, Logs, Backup, Advanced #### [SSH Access](https://docs.start9.com/start-wrt/ssh.html) Access your router's command line over SSH for advanced troubleshooting, package management, or direct configuration. SSH accepts both password authentication (using your admin password) and public key authentication. > SSH provides root access to the underlying OpenWrt system. Misconfiguration can break networking, lock you out, or require a factory reset. Only use SSH if you are comfortable with the Linux command line. Sections: Adding an SSH Key, Connecting, Removing an SSH Key #### [Backups](https://docs.start9.com/start-wrt/backups.html) Back up your router's configuration so you can restore it after an update, factory reset, or hardware failure. Backups capture your settings — security profiles, Wi-Fi passwords, firewall rules, VPN configurations, SSH keys, and other customizations. Sections: Creating a Backup, Restoring a Backup, What Is Included #### [Factory Reset](https://docs.start9.com/start-wrt/factory-reset.html) A factory reset restores StartWRT to its default state at unboxing. There are two ways to reset: from the web interface (soft reset) or from a microSD card (reflash). Sections: Soft Reset (Web Interface), Reflash (microSD), What Gets Wiped, Lost Wi-Fi Password ### Reference #### [CGNAT (Carrier-Grade NAT)](https://docs.start9.com/start-wrt/cgnat.html) CGNAT is a networking technique where your ISP places your home network behind an additional layer of NAT that you do not control. If your ISP uses CGNAT, several StartWRT features will not work. Sections: What Is CGNAT?, Who Is Affected?, Impact on StartWRT, The Solution: StartTunnel, How to Check #### [Architecture](https://docs.start9.com/start-wrt/architecture.html) StartWRT is a router operating system built on OpenWrt with a custom Rust backend and Angular web interface. It reimagines the router experience by abstracting raw networking primitives — VLANs, firewall zones, subnets, routing tables — behind the Security Profile model. The result is enterprise-grade network segmentation that anyone can configure in minutes. Sections: What StartWRT Adds to OpenWrt, How It Works, Security Profile Internals, Automatic Port Forwarding Internals, Network Isolation, Multi-Password Wi-Fi, Security, TLS and Certificates, IPv6, Source Code #### [Hardware](https://docs.start9.com/start-wrt/hardware.html) Every router Start9 has sold, newest first. Each entry lists the specifications and how to tell that model apart. What is for sale now is at store.start9.com. For servers, see Start9 Hardware in the StartOS documentation. Sections: Start9 Router #### [FAQ](https://docs.start9.com/start-wrt/faq.html) Answers to common questions about StartWRT's features, security model, and compatibility. Sections: What is StartWRT?, How is StartWRT different from stock OpenWrt?, How does multi-password Wi-Fi work?, Is VPN chaining really more private?, Does StartWRT work with my ISP?, Can I still use the OpenWrt CLI?, What happens if I forget my admin password?, What if I lose my Wi-Fi sticker password?, Why doesn't one of my profiles have IPv6 Internet access?, Does StartWRT phone home or collect telemetry?, Can I use StartWRT with StartOS?, Why can't my StartOS server or game console open ports on its own?, Where can I report bugs or request features? ## Start9 Support #### [Your Account](https://docs.start9.com/support/account.html) A Start9 Support account is created with an access code, and is yours for life. This page covers where to find your code, creating the account, and getting back in when you forget your password. Sections: Access Codes, Creating an Account, Signing In and Out, Forgot Your Password #### [Installing the App](https://docs.start9.com/support/installing-the-app.html) Start9 Support installs as an app on your phone or computer, with its own icon and window. On iPhone and iPad, the installed app is the only place notifications work. Sections: Install It, Updates #### [Chats](https://docs.start9.com/support/chats.html) Every request for help is a chat, opened under the topic it is about. This page covers starting one, what you can do in it, and what happens when it closes. Sections: Starting a Chat, In a Chat, Your Chats, Paused and Closed Chats, Closing a Chat, Exporting a Chat #### [Dux and Helix](https://docs.start9.com/support/dux-and-helix.html) Every chat starts with Dux, Start9's AI support technician, and a person from Start9 joins when one is needed. This page covers who answers, how to reach a person, and what you can see of the work on your case. Sections: Dux, Reaching a Person, Helix #### [Privacy](https://docs.start9.com/support/privacy.html) Everything you write in a chat is seen by Start9's staff and by Dux, whose AI providers process it. This page covers what is masked before Dux sees it, and how to share something only Start9's staff can see. Sections: Write as in a Public Group Chat, Sharing Privately, If You Shared a Secret #### [Notifications](https://docs.start9.com/support/notifications.html) Start9 Support notifies you on each device you turn it on for, whenever Start9 replies in one of your chats — whether or not the app is open. This page covers turning notifications on, and what to do when they don't arrive. Sections: What You're Notified Of, Turning Them On, When Notifications Don't Arrive #### [Email](https://docs.start9.com/support/email.html) Start9 Support emails you a reminder when a reply goes unread. This page covers it and how to turn it off. Sections: Unread-Reply Reminders, Turning Reminders Off #### [Settings](https://docs.start9.com/support/settings.html) Settings holds your profile, your password and email, your preferences, and how Start9 Support reaches you. Open it from the account menu, under your name at the bottom of the chat list. Sections: Profile, Security, Preferences, Notifications, Email