Pia Server

Pia Server is the self-hosted backend for the Pia desktop client. It provides cloud sync of templates, providers, sessions, memory and todos; an end-to-end encryption (E2EE) protocol so the server never sees your decrypted data; an AI proxy that fans client requests out to OpenAI, Azure, Anthropic or any compatible provider; and a Blazor admin UI for tenant administration.

It is an ASP.NET Core (.NET 10) Minimal-API service backed by SQLite (development) or PostgreSQL (production). Sensitive material — JWT signing keys, the encryption master key, OAuth secrets — comes from environment variables in production.

What’s in this section

Local Docker setup Spin up the server locally with Docker Compose for development and evaluation.

Production deployment Deploy to a Hetzner Cloud VPS with Caddy, PostgreSQL, automated TLS, and GitHub Actions.

Admin overview Manage accounts, devices, audit log, license status, and runtime policies from the web UI.

Architecture Modules, the data model, the sync protocol, and where E2EE sits in the request path.

Security The E2EE key hierarchy, recovery codes, and disk-level protection.

API reference REST contract for clients — auth, sync, AI proxy, and E2EE endpoints.

Audience

These pages are written for two readers. Self-hosters running Pia for themselves or a small team — start with Local Docker setup and then Production deployment. Enterprise administrators managing Pia for an organization — go to the Admin overview for tenant administration, then Security to understand what is and isn’t encrypted.