---
title: bluesky-pds
draft: false
date: 2025-01-18
---

|              |                                                                                                          |
| ------------ | -------------------------------------------------------------------------------------------------------- |
| image        | [quartz-docker image](https://code.modernleft.org/gravityfargo/-/packages/container/bluesky-pds/latest)  |
| base project | [GitHub - bluesky-social/pds](https://github.com/bluesky-social/pds)                                     |
| image source | [Forgejo - gravityfargo/bluesky-pds-docker](https://code.modernleft.org/gravityfargo/bluesky-pds-docker) |

```bash
docker pull code.modernleft.org/gravityfargo/bluesky-pds:latest
```

---

A self-contained Docker image for the [Bluesky PDS (Personal Data Server) ](https://github.com/bluesky-social/pds) for use with Traefik. This image is pinned to v0.4.74.

It is required to run the instance behind a proxy (like [Traefik](https://doc.traefik.io/traefik/)) to generate SSL certificates. This will not work otherwise. The standard pds install includes caddy to handle this. A wildcard DNS assignment along with a wildcard SSL certificate is required. I use Cloudflare for this, see the screenshot below.

This is not intended for production, and I am not responsible for any data loss or security issues. This is a personal project, and I am not affiliated with Bluesky.

## Deployment

Before changing images or upgrading, always backup the files made in the volume.

### Requirements

I haven't verified these are the minimum requirements, but they are what I found to be necessary during development. I probably had some dependencies installed already.

#### Manjaro/Arch

```bash
sudo pacman -S jq
```

#### Debian/Ubunutu

```bash
sudo apt install make xxd
```

### Setup

Generate secrets and add them to `.env` file. See [example.env](example.env) as an example.

```bash
# Generate secret environment variables
echo PDS_ADMIN_PASSWORD: $(openssl rand --hex 16)

echo PDS_JWT_SECRET: $(openssl rand --hex 16)

echo PDS_PLC_ROTATION_KEY_K256_PRIVATE_KEY_HEX: $(openssl ecparam --name secp256k1 --genkey --noout --outform DER | tail --bytes=+8 | head --bytes=32 | xxd --plain --cols 32)
```

### Docker Compose Setup

Full list of additional Environment Variables provided by bluesky upstream can be found in the [packages/pds/src/config/env.ts](https://github.com/bluesky-social/atproto/blob/main/packages/pds/src/config/env.ts)

By default, the image uses 1000:1000 as the UID:GID for the user. This can be changed by setting the `PUID` and `PGID` environment variables. The compose element `hostname` must be the same value as `PDS_HOSTNAME`.

![[traefik]]
![[standalone]]