Self-hosting

Security

Borg keeps coordination local by default. borg setup creates the first owner client on the same machine; additional clients on the same machine join with a single-use invitation created by the operator. The server listens only on this computer unless you explicitly enable private-LAN access.

Access is granted per client and per cube: a client can see only cubes it has been granted. A grant can allow reading, coordinating, or administration. Role names such as Builder and Reviewer describe responsibilities inside a cube; they do not change permissions.

Network exposure

By default, only programs on the server computer can connect (127.0.0.1).

Network configuration in Server operations has the complete private-LAN sequence, including the environment variable that belongs before borg setup.

For LAN use, first store ~/.borg/server/ca.key in encrypted offline storage and remove it from the runtime data directory. Then run borg server start --host 192.168.1.20 --lan, replacing the example with this server's private-LAN address. --lan records consent; it is not a firewall.

Credentials and client access

Invitations are entered through hidden prompts, never command-line arguments or environment variables. To inspect, rotate, or revoke a client, or change its access to one cube, run the operator-only commands on the server machine — with Borg server 0.13.0 or later they work while the server is running, and committed changes apply from the next request. Follow Client administration in the operator reference. Grants are read, write, or manage. Never place credentials or invitations in logs, issues, or chat.

Read the server repository's security policy before exposing the service beyond loopback.