roof/pic
1
0
Fork 0
Code Issues Pull Requests Actions Wiki Activity
Page: User – Start Here
Pages
ADR – 001 Store Images Are Signed and Verified by Cells ADR – 002 Named Connection Instances for Connectivity ADR – 003 All Optional Functionality Ships as Store Services Admin – Back Up and Restore Admin – Configure Connectivity Admin – Configure Domains and TLS Admin – Install and First Run Admin – Logging and Audit Admin – Manage Peers Admin – Manage Services Admin – Monitor and Troubleshoot Admin – Overview Archive – ADR 004 The Wiki Is the Single Documentation Source Archive – User Guide Dev – API Reference Dev – Architecture Dev – Build a Store Service Dev – Install Internals Dev – Overview Dev – Service Manifest Reference Dev – Testing Home Meta – Glossary Meta – Template ADR Meta – Template Runbook User – Connect to the VPN User – FAQ User – Start Here User – Troubleshooting User – Use Your Services
Clone
User – Start Here
Dmitrii Iurco edited this page 2026-06-11 15:39:28 -04:00
Table of Contents

Status: Active | Owner: @roof | Updated: 2026-06-11

User – Start Here

What is a Personal Internet Cell?

A Personal Internet Cell is a small server you run at home (or on a cheap virtual server). It does the things that big tech companies normally do for you — but on your own hardware, under your control.

Concretely, it gives you:

  • A private VPN. Your phone, laptop, and other devices connect to your cell over an encrypted WireGuard tunnel. Traffic you want to route through your home network goes through your cell instead of a stranger's server.
  • Private DNS. Your connected devices use your cell's DNS resolver. Nobody else sees your queries.
  • Accurate time (NTP). Your devices synchronise their clocks from your cell.
  • HTTPS. Every service your cell runs gets a real TLS certificate automatically.
  • Optional store services. You can install email, calendar/contacts, or file storage from the built-in service store. These run on your cell — your data does not leave your hardware.

Do I need to be technical?

You need to be comfortable running a Linux server and following instructions. You do not need to edit config files by hand or write any code. Everything happens through a browser-based interface after the initial install.

What hardware do I need?

Any always-on Linux machine with:

  • 2 GB or more RAM
  • 10 GB or more disk
  • A network connection

A Raspberry Pi 4, an old laptop, a NUC, or a cheap VPS all work. The supported Linux distributions are Debian, Ubuntu, Fedora, RHEL, and Alpine.

How do I install it?

Run this single command on your Linux machine:

# Run on: your Linux server, as a user with sudo access
curl -fsSL https://install.pic.ngo | sudo bash

Before running any script piped through sudo bash, you can review it first:

# Run on: your Linux server
curl -fsSL https://install.pic.ngo | less

The installer runs 7 steps. It detects your OS, installs Docker and the other dependencies, creates a pic system user, clones the code to /opt/pic, generates the initial configuration, starts the core containers, and waits for everything to be healthy. The whole process takes a few minutes on a typical internet connection.

When it finishes, it prints something like:

Open your browser: http://192.168.1.10:8081/setup

Open that URL.

The setup wizard

A browser-based wizard appears automatically. It asks you four things:

  1. Cell name — a short name like myhome or alices-cell. This becomes part of your domain name if you use the pic.ngo option.
  2. Domain mode — how your cell gets an HTTPS certificate. If you are not sure, choose pic.ngo for internet-facing use, or lan for a local-only setup. See Admin – Configure Domains and TLS for a full explanation.
  3. Timezone — your local timezone.
  4. Admin password — at least 12 characters, with uppercase, lowercase, and a digit.

Click Complete Setup. The wizard creates your admin account and redirects you to the login page.

Log in with username admin and the password you just set.

What now?

You are in the dashboard. From here you can:

The peer dashboard (for invited users)

If you were invited to join someone else's cell rather than running your own, you are a peer. Your admin creates a WireGuard configuration file or QR code for you. Once you connect, open the cell's web address in a browser and log in with the credentials your admin gives you.

The peer dashboard shows:

  • Your VPN connection status
  • Connection info for any services the admin has set up for you (server addresses, ports, your username)

The admin controls and settings pages are not visible to peers.

What is split-horizon DNS?

Split-horizon DNS means your cell's domain name (for example, myhome.pic.ngo) resolves to different addresses depending on whether you are on the VPN or not:

  • Inside the VPN: the name resolves to your cell's internal WireGuard address. Traffic stays inside the tunnel.
  • Outside the VPN: the name resolves to your cell's public IP.

You do not need to do anything — it works automatically.

Didn't work? → User – Troubleshooting

Personal Internet Cell

Home

New here?

User – Start Here User – FAQ

Users

User – Connect to the VPN User – Use Your Services User – Troubleshooting

Admins

Admin – Overview Admin – Install and First Run Admin – Configure Domains and TLS Admin – Manage Services Admin – Configure Connectivity Admin – Manage Peers Admin – Back Up and Restore Admin – Logging and Audit Admin – Monitor and Troubleshoot

Developers

Dev – Overview Dev – Architecture Dev – Build a Store Service Dev – Service Manifest Reference Dev – API Reference Dev – Testing Dev – Install Internals

Decisions (ADRs)

ADR – 001 Store Images Are Signed and Verified by Cells ADR – 002 Named Connection Instances for Connectivity ADR – 003 All Optional Functionality Ships as Store Services

Meta

Meta – Glossary Meta – Template Runbook Meta – Template ADR

Archive

Archive – User Guide Archive – ADR 004 The Wiki Is the Single Documentation Source