Personal
The node belongs to its operator. Private services bind to the local machine unless the operator chooses otherwise.
Personal infrastructure · experimental local node
Identity that remains
in your hands.
Hestia is a personal, local-first security and open-communications server. It keeps keys, recovery, provenance and rights close to the person they belong to.
scripts/hestia upLocal-first · EPL-2.001 · The sovereign hearth
Built to remain in your hands
A home for your
digital identity.
Run the ledger at home. Link external identities to keys you own. Record signed work without turning an institution into the owner of the person behind it.
Durable
PostgreSQL holds an append-only record of identity, approvals, accreditation and signed work.
Replaceable
Open protocols, explicit interfaces and independently run authorities keep the infrastructure from becoming the identity.
02 · Independent recovery
No single keeper
holds the answer.
The browser encrypts a recovery package, divides its secret between independently operated keepers, and reconstructs it only after an authorised ceremony.
- Recovery policy
- Two of three keepers, plus the recovering browser
- Keeper material
- Sealed to the browser’s ephemeral ceremony key
- Hestia records
- Hashes, approvals, rotation and accreditation—not plaintext shares
03 · Recovery ceremony
Two of three, plus you
Recovery without
a master key.
Authorisation and secret reconstruction are separate steps. Independent decisions come first; threshold cryptography follows.
- 01 · CREATEOwn the identityThe browser creates and encrypts identity material locally.
- 02 · DIVIDEChoose keepersA recovery secret is split across independent authorities.
- 03 · AUTHORISEProve the requestEach keeper evaluates the ceremony under its own policy.
- 04 · RECONSTRUCTRotate the keyApproved shares restore access; normal recovery produces a new key.
04 · Local architecture
One deliberately small stack
Every boundary
made visible.
Hestia combines a private application origin, a real ledger, minimal authentication, and blind communication relays under one operator command.
OWNUser keysbrowser→AUTHORISERecoverykeepers→SERVEHopliteorigin→RECORDPostgreSQLledger
Development interfaces bind to loopback. Publishing a node remains an explicit operator choice.
Identity and work history remain inspectable without storing plaintext recovery evidence.
Signalling coordinates peers but cannot read or validate the recovery secret.
GoTrue is retained for sessions; unrelated Supabase services are not part of the stack.
05 · Run your own node
Keep the hearth
close to home.
Hestia requires Docker with Compose, OpenSSL and PostgreSQL client tools. Initialisation creates local secrets at mode 0600 and never prints them.
scripts/hestia init
scripts/hestia doctor
scripts/hestia up- Status
- Experimental local node
- Distribution
- Source build
- License
- EPL-2.0