Run a Psiphon Conduit node on a ProVM

A Psiphon Conduit node relays encrypted traffic between Psiphon users on restricted networks and the Psiphon network. This guide runs one in Docker on a ProVM.

Conduit is a bridge, not an exit: the websites a user visits do not see your VM’s IP address as the source of the traffic.

Psiphon’s broker knows each node by a key that the node creates on its first start. A node that stays online builds a reputation and is sent more users, so a new node can stay quiet for hours or days. Keep the key: the commands below store it in a Docker volume.

Before you start

• A Doprax account with credit.
• A ProVM with Ubuntu. The smallest plan, P1, is enough to start. See Plans and prices. The standard ProVM plans list inbound and outbound traffic as Free on the Create Virtual Machine page.

1. Create the VM and connect

Create the VM as described in Create your first virtual machine, with ProVM as the provider and Ubuntu as the operating system. Then connect:

ssh root@YOUR_VM_IP

2. Install Docker

curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
docker --version

3. Start the Conduit node

docker run -d \
  --name conduit \
  --restart unless-stopped \
  -v conduit-data:/home/conduit/data \
  -p 127.0.0.1:9090:9090 \
  ghcr.io/psiphon-inc/conduit/cli:latest \
  start \
  --max-common-clients 50 \
  --bandwidth 50 \
  --data-dir /home/conduit/data \
  --metrics-addr 0.0.0.0:9090

What the options do:

Option	Meaning
--restart unless-stopped	Docker starts the node again after a crash or a reboot of the VM
-v conduit-data:/home/conduit/data	Keeps the node’s key in a Docker volume named conduit-data
-p 127.0.0.1:9090:9090	Makes the node’s statistics readable from the VM itself, not from the internet
--max-common-clients 50	At most 50 users at the same time
--bandwidth 50	At most 50 Mbit per second in total. -1 means no limit

The image and the values are the ones in Psiphon’s own Compose file.

Caution

Do not leave out the -v line. Without the volume, the key is lost when the container is removed, and the node starts again with no reputation.

4. Confirm that it is running

docker logs -f conduit

The node prints a line marked [STATS] at intervals, with the number of users that are connecting and connected, the traffic up and down, and the uptime. Leave the log with Ctrl+C; the node keeps running.

5. Change the limits

To change the limits, remove the container and start it again with other numbers. The volume keeps the key, so the node keeps its reputation.

docker rm -f conduit

docker run -d \
  --name conduit \
  --restart unless-stopped \
  -v conduit-data:/home/conduit/data \
  -p 127.0.0.1:9090:9090 \
  ghcr.io/psiphon-inc/conduit/cli:latest \
  start \
  --max-common-clients 100 \
  --bandwidth 5 \
  --data-dir /home/conduit/data \
  --metrics-addr 0.0.0.0:9090

Psiphon’s deployment guide says to lower --max-common-clients when the machine runs short of processor or memory.

6. Read the node’s statistics

The node publishes its numbers in the Prometheus format. Read them on the VM:

curl -s http://127.0.0.1:9090/metrics | grep conduit_

conduit_connected_clients is the number of users connected now. conduit_bytes_uploaded and conduit_bytes_downloaded are the traffic relayed.

Good to know

• Use ProVM. On a ProVM all ports are open. On a Hetzner VM only TCP ports 80, 443 and 19000 to 19100 can be reached from the internet.
• To update the node, fetch the new image with docker pull ghcr.io/psiphon-inc/conduit/cli:latest, then repeat step 5 with your numbers.
• A stopped VM is charged at its full price. To stop paying, delete the VM.