Why run your own SimpleX relay
SimpleX has no user identifiers at all: no phone number, no username, not even a persistent key that a server can use to link your conversations. Messages travel through SMP relays (simplex messaging protocol servers) chosen per connection, and files through XFTP relays. The design means a relay operator learns little, but "little" is not nothing: a relay sees the IP addresses that connect to it and the timing of traffic through the queues it hosts. By default your app uses the preset relays run by the SimpleX team and a few partners.
Running your own relay moves that metadata to a machine you control, spreads the network across more operators, and lets you hand contacts a server address that no one else is watching. It is also one of the cheapest things you can self-host: the servers are single static binaries written in Haskell with no database, and the smallest VPS plan runs both with room to spare. Paying for the box in Monero without an account completes the picture; the relay is then not linked to you by billing data either.
The official docs cover three install paths: the installation script (binaries plus systemd units plus update and backup helpers), Docker Compose, and manual. This guide uses the script because it is what the SimpleX team runs on their own servers and it is the easiest to keep updated. It supports Ubuntu, which is the default image here.
Sizing: the smallest plan
smp-server holds queues in memory with an append-only store log on disk, and xftp-server stores file chunks for a few days before expiring them. A relay for yourself and a few dozen contacts uses a couple of hundred MB of RAM and almost no CPU. The XFTP quota you set is the only real disk consumer.
- BVX11 (2 vCPU, 2 GB RAM, 40 GB NVMe) from $10/mo in Germany or Finland is enough for both servers with a 20 GB XFTP quota. It is also available in the US ($32) and Singapore ($19) if you want a relay close to your contacts.
- BVCX23 (2 vCPU, 4 GB RAM, 40 GB) at $11/mo in the EU gives twice the RAM for one dollar more; pick it if you expect to also run Tor and a web server on the box.
- Traffic: a personal relay moves a few GB a month. The included 20 TB is not a constraint.
- A relay for a community or a public listing should be bigger (more RAM for queues, more disk for XFTP) and ideally split SMP and XFTP across two servers so each can own port 443.
Prepare the server
Everything below assumes a fresh Ubuntu 24.04 image and a root shell (prefix sudo if you created a user). Patch first, then lock down SSH and the firewall before anything else is listening.
apt update && apt full-upgrade -y
apt install -y ufw unattended-upgrades curl gnupg
# SSH: keys only. Put your public key in /root/.ssh/authorized_keys first and
# confirm you can log in with it before disabling passwords.
cat > /etc/ssh/sshd_config.d/00-keys-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF
sshd -t && systemctl restart ssh
# Firewall: deny everything inbound except SSH for now.
ufw default deny incoming
ufw default allow outgoing
ufw allow OpenSSH
ufw --force enableInstall smp-server and xftp-server
Create DNS records first: smp.example.com and xftp.example.com (A and AAAA) pointing at the server. The hostname goes into the server certificate and into the address you share, and the SimpleX docs note that clients will increasingly build links from server domain names. Then fetch the install script, verify its checksum against the one published on the SimpleX docs page, and run it twice: once choosing option 1 (smp-server), once choosing 2 (xftp-server).
cd /tmp
curl --proto '=https' --tlsv1.2 -sSf https://raw.githubusercontent.com/simplex-chat/simplexmq/stable/install.sh -o simplex-server-install.sh
# Take the SHA-256 from https://simplex.chat/docs/server.html (it changes with each script revision).
echo 'PASTE_SHA256_FROM_THE_DOCS simplex-server-install.sh' | sha256sum -c
chmod +x simplex-server-install.sh
./simplex-server-install.sh # type 1 for smp-server
./simplex-server-install.sh # run again, type 2 for xftp-server
rm simplex-server-install.sh
ls -l /usr/local/bin/smp-server /usr/local/bin/xftp-server /usr/local/bin/simplex-servers-update
id smp && id xftpThe script installs the latest release binaries from GitHub, creates the smp and xftp system users, the directories under /etc/opt and /var/opt, and systemd units named smp-server and xftp-server. It also drops simplex-servers-update, which is how you upgrade later.
Now initialise each server. The flags below enable the store log (so queues survive restarts), allow queue creation without a password (so your contacts can connect to you through it; add --password if you want a private relay), enable the control port, tell smp-server to use a local SOCKS proxy for reaching onion-only peers, and set the domain. Keep the output: it prints the server address with the certificate fingerprint.
su smp -c 'smp-server init --yes \
--store-log \
--no-password \
--control-port \
--socks-proxy \
--source-code \
--fqdn=smp.example.com'
su xftp -c 'xftp-server init --store-log \
--fqdn=xftp.example.com \
--quota 20gb \
--path /srv/xftp/'
cat /etc/opt/simplex/fingerprint
cat /etc/opt/simplex-xftp/fingerprintPorts, Tor onion address and the shareable address
By default smp-server listens on 5223 and 443, and xftp-server on 443. On a single box both cannot own 443, so give 443 to XFTP (its clients expect it) and restrict SMP to 5223. If you want SMP on 443 as well for users behind restrictive firewalls, that is the case for a second $10 server. Edit /etc/opt/simplex/smp-server.ini and set the port line in the TRANSPORT section, then open the ports.
# /etc/opt/simplex/smp-server.ini
# [TRANSPORT] port: 5223 (was 5223,443)
# [WEB] https: 443 commented out (the info page would also want 443)
sed -i 's/^port: .*/port: 5223/' /etc/opt/simplex/smp-server.ini
sed -i 's/^https: 443/# https: 443/' /etc/opt/simplex/smp-server.ini
grep -n -E '^(port|https|host):' /etc/opt/simplex/smp-server.ini
ufw allow 5223/tcp comment 'simplex smp'
ufw allow 443/tcp comment 'simplex xftp'
systemctl enable --now smp-server xftp-server
journalctl -u smp-server -n 20
journalctl -u xftp-server -n 20A SimpleX server address can carry two hostnames: the public one and an onion. Clients that route through Tor use the onion; clients that do not use the clearnet name, and two people can still connect through the same relay when only one of them is on Tor. Install Tor from the Ubuntu repository (or the Tor Project’s own apt repository if you want the newest release) and add two hidden services. The same Tor instance provides the SOCKS port that smp-server uses to reach onion-only peers (the --socks-proxy flag at init).
apt install -y tor
cat >> /etc/tor/torrc <<'EOF'
SocksPort 127.0.0.1:9050
HiddenServiceDir /var/lib/tor/simplex-smp/
HiddenServicePort 5223 127.0.0.1:5223
HiddenServiceDir /var/lib/tor/simplex-xftp/
HiddenServicePort 443 127.0.0.1:443
EOF
systemctl restart tor
sleep 5
cat /var/lib/tor/simplex-smp/hostname
cat /var/lib/tor/simplex-xftp/hostnameAssemble the addresses from the fingerprint files and both hostnames, then add them in the app under Settings, Network and servers. Scan the QR or paste the string; the app tests the server before saving. Addresses look like this.
smp://FINGERPRINT_FROM_/etc/opt/simplex/[email protected],abcd...xyz.onion
xftp://FINGERPRINT_FROM_/etc/opt/simplex-xftp/[email protected],efgh...uvw.onion
# If you initialised smp-server with --password, it goes after the fingerprint:
# smp://FINGERPRINT:[email protected],....onionOptional but encouraged by the project: serve a server information page over HTTPS (operator, conditions, source code link) from the same host. The docs show a Caddy configuration on port 8443 and a small script that copies Caddy’s certificate into /etc/opt/simplex for the WEB section of smp-server.ini. It is required only if you intend to list the relay publicly.
Operations: updates, backups, monitoring, firewall
- Updates: simplex-servers-update downloads the current release binaries and restarts the services. Subscribe to the simplexmq GitHub releases; new protocol versions are backwards compatible but you want the fixes.
- Backups: the identity of your relay is /etc/opt/simplex and /etc/opt/simplex-xftp (certificates, keys, ini files). Copy them off the server once, encrypted. The store log in /var/opt/simplex is operational state; losing it drops in-flight messages but not the server identity. The systemd units already snapshot the store log on stop.
- Monitoring: journalctl -u smp-server -f shows connections; the control port (telnet 127.0.0.1 5224 with the admin password from the ini) exposes live stats. Set log_stats: on in the STORE_LOG section if you want daily CSV statistics for a dashboard.
- Firewall: ufw status should list OpenSSH, 5223/tcp and 443/tcp. Nothing else. The control port is bound to localhost.
- Capacity: XFTP removes files after the configured expiry (48 hours by default); the quota is a hard ceiling. df -h /srv/xftp once in a while is all the capacity planning a personal relay needs.
- Privacy of the box itself: the relay logs client IPs only at the level you configure. Leave log_level at the default and do not add request logging in front of it.
Which plan to pick
Take BVX11 (2 vCPU, 2 GB, 40 GB NVMe, from $10/mo) in Germany or Finland for a relay that serves you and your contacts, or BVCX23 ($11/mo) if you also want Tor and the information page comfortably. Choose the US or Singapore BVX11 if most of your contacts are there; SMP latency is small but round trips add up in calls. Configure a server with Ubuntu 24.04, pay in Monero or Bitcoin for as many days as you want to try it, and the root login arrives by email when the payment confirms.