Set up Device Inbox on an always-on Linux server
Last updated: 2026-08-09
Device Inbox sends a file from My Devices in your browser to a server, NAS or workstation you own. The browser encrypts it; only that machine decrypts and saves it.
A server receiver must survive a closed SSH window and a reboot. The recommended installer below creates the folder and installs a real systemd service; inbox run is only the foreground diagnostic/container entrypoint.
Install the resident receiver
Run login once as the operator, then download and inspect the short installer before giving it root access. The script copies the device credential without printing it, creates a dedicated relayium account, enrols its receive key, installs the hardened unit, starts it now and enables it after reboot.
relayium update
relayium login --device-name prod-backup-1
# Download, inspect, then install the always-on service:
curl -fsSLO https://relayium.com/inbox-server-install.sh
less inbox-server-install.sh
sudo sh inbox-server-install.sh --dir /srv/relayium-inbox- The recommended receive directory is /srv/relayium-inbox. The hardened service cannot access /root or another user's home directory.
- The installer uses a dedicated low-privilege account; received files and the private receive key are not owned by root.
- If you previously enabled a foreground inbox, its old local state is moved to a timestamped, recoverable archive only after the service starts successfully.
Check the service, logs and files
These four commands distinguish a running process, its recent logs, Relayium's local/server truth and the directory itself. A green systemd state alone is not proof that the account, key and folder are usable.
sudo systemctl status relayium-inbox.service
sudo journalctl -u relayium-inbox.service -f
sudo -u relayium relayium inbox status --config-dir /var/lib/relayium-inbox/config
ls -la /srv/relayium-inbox- Files land in /srv/relayium-inbox unless you passed a different --dir to the installer.
- Existing files are never overwritten. Name collisions get a safe numbered name; received content is never opened, executed or extracted.
- The My Devices row shows the editable label and the last server-observed IP, which may be a NAT or VPN address.
What happens when the server is offline or crashes
The encrypted task waits at Relayium while the server is offline. Uploaded is not shown as saved: saved appears only after authenticated decryption, verification and durable local commit.
- systemd restarts the worker after a process failure and starts it after reboot.
- A partial download remains private staging data and is never exposed as a completed file.
- A durable journal makes a crash after commit idempotent: restart reports the same save without duplicating the file.
- If the chosen directory disappears later, the worker does not recreate it; this avoids writing beneath a missing mount and reports attention required instead.
Pause, resume or remove receiving
Run administrative inbox commands as the same service account and config directory. pause keeps keys and queued work; resume continues; disable clears central first and deletes private keys only after that succeeds.
sudo -u relayium relayium inbox pause --config-dir /var/lib/relayium-inbox/config
sudo -u relayium relayium inbox resume --config-dir /var/lib/relayium-inbox/config
sudo -u relayium relayium inbox disable --config-dir /var/lib/relayium-inbox/config- Do not use inbox run in an SSH window as the permanent server setup; closing the window stops it.
- Use systemctl disable --now relayium-inbox.service only to stop the process. Use inbox disable when you also intend to revoke the inbox and its keys.
Frequently asked questions
Does Relayium see file names or plaintext?
No. The browser encrypts the manifest and file bytes and seals the content key to the selected device. Central stores ciphertext and routing state only.
Why not receive into /root/inbox?
The recommended service deliberately runs without root and with home-directory access blocked. /srv/relayium-inbox gives it one narrow writable area.
Can I install it manually?
Yes. relayium inbox service systemd-user or systemd-system prints a machine-specific unit and commands; launchd and container descriptions also exist. The inspected installer is the shorter Linux server path.
Once the service reports ready, send a file from your own device card.
Open My Devices