Home / Guides / IPFS node setup guide

Guide

Run an IPFS node on a VPS.

Q: How do I stop it filling the disk?

Set `Datastore.StorageMax` and run the daemon with `--enable-gc`, as in this guide.

IPFS lets you store and serve content by its hash. Kubo is the reference implementation. This guide installs Kubo on Ubuntu 24.04, applies the server profile and runs it as a service.

Updated 2026-11-11 · Published by AnonVPS

What you need

A BASE plan or larger. Choose IPFS Node in the configurator.
Disk and transfer in proportion to what you pin. Set a storage limit so the node cannot fill the disk.

1. Update the server and create a user

Log in as root over SSH or the in-browser console, then update the system and create an unprivileged user for daily work. The node itself will run under its own service account, never as root.

Update and create an admin user

apt update && apt full-upgrade -y
adduser admin
usermod -aG sudo admin
rsync --archive --chown=admin:admin ~/.ssh /home/admin
# log out, then log back in as admin

2. Open only the port the node needs

Allow SSH and the IPFS peer-to-peer port. Keep the RPC and API ports closed to the internet: they are not meant to face the public network.

Firewall

sudo apt install -y ufw
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 4001
sudo ufw enable
sudo ufw status

3. Create the service account

Account

sudo useradd --system --create-home --home-dir /var/lib/ipfs --shell /usr/sbin/nologin ipfs

4. Download and verify Kubo

Get the current release from dist.ipfs.tech. Each download has a checksum file next to it.

Download

VER=VERSION_FROM_THE_DOWNLOAD_PAGE   # example format: v0.38.0
cd /tmp
wget https://dist.ipfs.tech/kubo/$VER/kubo_${VER}_linux-amd64.tar.gz
wget https://dist.ipfs.tech/kubo/$VER/kubo_${VER}_linux-amd64.tar.gz.sha512

Verify

sha512sum --check kubo_${VER}_linux-amd64.tar.gz.sha512

Install

tar -xzf kubo_${VER}_linux-amd64.tar.gz
sudo install -m 0755 -o root -g root kubo/ipfs /usr/local/bin/ipfs
ipfs --version

5. Initialise with the server profile

The server profile disables local-network discovery, which is not wanted on a hosted machine. Set a storage limit that leaves room for the operating system.

Initialise and limit storage

sudo -u ipfs env IPFS_PATH=/var/lib/ipfs/.ipfs ipfs init --profile server
sudo -u ipfs env IPFS_PATH=/var/lib/ipfs/.ipfs ipfs config Datastore.StorageMax 20GB
sudo -u ipfs env IPFS_PATH=/var/lib/ipfs/.ipfs ipfs config Addresses.API /ip4/127.0.0.1/tcp/5001
sudo -u ipfs env IPFS_PATH=/var/lib/ipfs/.ipfs ipfs config Addresses.Gateway /ip4/127.0.0.1/tcp/8080

6. Run it with systemd

/etc/systemd/system/ipfs.service

sudo tee /etc/systemd/system/ipfs.service >/dev/null <<'EOF'
[Unit]
Description=IPFS (Kubo) daemon
After=network-online.target
Wants=network-online.target

[Service]
Environment=IPFS_PATH=/var/lib/ipfs/.ipfs
ExecStart=/usr/local/bin/ipfs daemon --enable-gc
User=ipfs
Group=ipfs
Type=simple
Restart=on-failure
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now ipfs
sudo systemctl status ipfs --no-pager

7. Check that it works

A healthy node shows peers. The add command prints a content ID (CID) for your file.

Status and a test file

export IPFS_PATH=/var/lib/ipfs/.ipfs
sudo -E -u ipfs ipfs id | head -5
sudo -E -u ipfs ipfs swarm peers | wc -l
echo 'hello from my node' > /tmp/hello.txt
sudo -E -u ipfs ipfs add /tmp/hello.txt

Keep the API private

The API (5001) can change your node. Bind it to localhost, as above, and reach it through an SSH tunnel.
If you serve a public gateway, put a reverse proxy with limits in front of port 8080 and read the abuse policy first. See the acceptable use policy.

FAQ

Common questions

Which ports does IPFS use?

4001 (TCP and UDP) for peers. Keep 5001 (API) and 8080 (gateway) on localhost unless you add a proxy.

How do I stop it filling the disk?

Set Datastore.StorageMax and run the daemon with --enable-gc, as in this guide.

Does pinning keep my files available?

Only while your node is online and has the data pinned. Others can keep copies too, but do not rely on that.

Can I run a public gateway?

Technically yes, but it brings abuse and bandwidth risk. Read the acceptable use policy first.

Keep reading

Blockchain node setup guide

How to run your own blockchain node on a VPS from scratch: choose a plan, secure the server, verify downloads, run a systemd service and check sync.

VPS hardening checklist: secure a new Linux server in 15 minutes

A practical checklist for a new Linux VPS: SSH keys, a non-root user, firewall, automatic updates and backups, with the commands.

Run a Tor onion service on a VPS

How to publish a website or admin panel as a Tor onion service on a VPS: install, configure, test and keep it private.

Order a server with the right plan preselected.

Open the configurator