Run a
Pixagram node

1Rent the server

Any cloud or hosting provider will do — Hetzner, OVH, Scaleway, DigitalOcean, Vultr, Linode, Contabo, Oracle, AWS, and hundreds of regional ones. Prefer one and a region that the current witnesses do not use. When you order, choose:

• Ubuntu 24.04 LTS (Debian 12 also works) on x86-64 / amd64. The published images are built for amd64 only; ARM instances will not run them.
• Size from the calculator above. SSD or NVMe, never a spinning disk.
• A public IPv4 address. Some providers charge a little extra or default to IPv6 only; peers need IPv4.
• Your SSH public key instead of a root password. Generate one on your computer first if you have none:

# on your own computer (macOS, Linux, or Windows PowerShell)
ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub          # paste this line into the provider's "SSH key" box

Most providers also offer a firewall or "security group" in their control panel, sometimes as checkboxes named allow SSH, allow HTTP, allow HTTPS. Turn it on and allow only what the node needs. It filters traffic before it reaches your machine, which matters later: Docker publishes ports past the server's own firewall.

2Log in and harden

The provider shows you the server's IP address. From your computer — the white boxes in every command are the values you replace with your own:

ssh root@SERVER_IP            # some providers use ubuntu@ or debian@ instead of root@
apt update && apt -y upgrade && apt -y install git curl nano ufw
adduser pixa && usermod -aG sudo pixa
rsync --archive --chown=pixa:pixa ~/.ssh /home/pixa   # your key now works for user pixa too

Now close the doors you do not need. Passwords off, root login off, then the firewall — port 2001 is what the chain uses to reach you.

sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/; s/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
systemctl restart ssh
ufw allow OpenSSH
ufw allow 2001/tcp
ufw allow 80/tcp && ufw allow 443/tcp && ufw allow 2002/tcp   # API node only — skip these three on a witness
ufw --force enable

The clock is not optional. Blocks carry timestamps and your slot is a three-second window; a clock off by a few seconds means missed blocks with no other symptom. Check it, and install a time daemon if it is not synchronised:

timedatectl                          # look for "System clock synchronized: yes"
apt -y install chrony                # only if it said no
apt -y install unattended-upgrades   # security patches on their own; kernel updates still need a reboot you schedule

From here on, work as pixa (ssh pixa@SERVER_IP) and put sudo in front of the commands that need root.

3Install Docker

Docker's own installer sets up the engine and the Compose plugin from its official repository:

curl -fsSL https://get.docker.com | sudo sh
sudo usermod -aG docker pixa
exit                                  # log out and back in so the group applies

docker compose version               # prints a version: you are ready
docker run --rm hello-world          # optional: proves containers start

Two commands do almost everything from now on: docker compose up -d starts (or restarts changed) containers in the background, and docker compose logs -f NAME follows what one of them prints. Press Ctrl+C to stop following; the container keeps running.

4Account and keys

A witness is an ordinary Pixagram account with two extra things registered on chain: a URL and a block-signing key. Create the account in the Pixagram app if you have none, and save its keys somewhere that survives a lost laptop — a password manager, and a copy on paper.

The signing key is a fresh pair you generate now. The image ships a wallet that does it offline — nothing is sent anywhere:

docker run --rm -it --entrypoint /home/hived/bin/cli_wallet pixadock/pixagram:mainnet -o
# at the "new >>>" prompt, type:
suggest_brain_key
# {"brain_priv_key": "…", "wif_priv_key": "5K…", "pub_key": "PIX7…"}
quit

wif_priv_key goes into config.ini in the next step; pub_key goes on chain in step 6. Keep both, and the brain key, with your other keys.

5Start the witness

The witness repository is a ready-made Compose stack: hived with the four plugins a producer needs, and the price feed. Clone it, then fill in two files.

git clone https://github.com/pixagram-blockchain/witness.git
cd witness
nano pixagram/config.ini

Near the end of config.ini two lines are commented out on purpose. Remove the # and fill them in — they ship disabled because hived crashes on an empty private-key rather than starting without one:

witness     = "your-account"
private-key = 5K…the wif_priv_key from step 4

Save with Ctrl+O, Enter, leave with Ctrl+X. Then the feed's file, and the permissions:

cat > .env <<'EOF'
WITNESS_ACCOUNT=your-account
WITNESS_WIF=5J…your ACTIVE key
EOF
chmod 600 .env pixagram/config.ini
docker compose up -d
docker compose logs -f pixagram

The first container fixes file ownership, then hived connects to api.pixagram.com:2001, downloads the chain and replays it. With a young chain this takes minutes; later it will take hours. You are synced when the log says entering live mode and then prints a line every three seconds as blocks arrive. Until step 6 is done the node will not be scheduled, and the feed container logs one error an hour because the account is not yet a witness — both are expected.

Two settings the bootstrap node used must stay absent here: enable-stale-production and required-participation = 0. They let a lone node produce on a chain it knows is stale; on a live network they remove the checks that keep you from producing during a split. The shipped file does not contain them. Leave it that way.

6Register on chain

Registration is one operation, witness_update, signed with your active key. It tells the chain your URL, your signing public key and three properties you vote on. Do it after step 5 shows entering live mode: from the moment you register you are scheduled, and a node that is still syncing misses its slots.

The easiest signer is a ten-line Node.js script using Pixagram's client library. Node 20 or newer is fine, on the server or on your computer.

mkdir ~/witness-tools && cd ~/witness-tools
npm init -y >/dev/null && npm install @pixagram/dpixa@1.5.4
nano register-witness.js

// register-witness.js — run once, and again whenever the URL, key or properties change
const { Client, PrivateKey } = require("@pixagram/dpixa/dist/dpixa.js");

const ACCOUNT     = "your-account";
const SIGNING_PUB = "PIX7…pub_key from step 4";
const URL         = "https://pixagram.com/@your-account/my-witness";
const ACTIVE_WIF  = process.env.ACTIVE_WIF;      // passed on the command line, never written here

const client = new Client(["https://api.pixagram.com"]);
const ops = [
  ["witness_update", {
    owner: ACCOUNT, url: URL, block_signing_key: SIGNING_PUB,
    props: { account_creation_fee: "0.001 PIXA", maximum_block_size: 262144, pxs_interest_rate: 0 },
    fee: "0.000 PIXA",
  }],
  ["account_witness_vote", { account: ACCOUNT, witness: ACCOUNT, approve: true }],   // vote for yourself
];

client.broadcast.sendOperations(ops, PrivateKey.fromString(ACTIVE_WIF))
  .then(r  => { console.log("broadcast, transaction", r.id); return new Promise(ok => setTimeout(ok, 9000)); })
  .then(()  => client.database.call("get_witness_by_account", [ACCOUNT]))
  .then(w  => console.log("on chain:", w.owner, "signs with", w.signing_key, "url", w.url))
  .catch(e => { console.error(e.message); process.exit(1); });

ACTIVE_WIF=5J… node register-witness.js
# broadcast, transaction 3f9c…
# on chain: your-account signs with PIX7… url https://…

Within a minute the schedule reshuffles and your node's log shows Generated block #… with timestamp …. If it shows Won't produce block because I don't have the private key for PIX… instead, the key in config.ini does not match the one you registered: fix one of them and restart with docker compose restart pixagram.

Check yourself from outside as well, on the witness status page or with one request. The number that matters is total_missed:

curl -s -X POST https://api.pixagram.com -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"condenser_api.get_witness_by_account","params":["your-account"],"id":1}'

Then ask for votes. Each account can vote for thirty witnesses; votes weigh by the voter's VESTS. Your URL page is where you make the case: location, hardware, whether you run an API node, how to reach you.

7Price feed

PXS is Pixagram's stable unit. Whenever the chain converts between PXS and PIXA — treasury payouts, the printed value of rewards — it uses the median of the prices all witnesses publish. A witness that publishes none, or one older than seven days, is flagged on the status page.

Pixagram's convention is that one PXS is worth one Big Mac. The feed container in your stack fetches the US Big Mac price from The Economist's index, divides it by a PIXA/USD reference price, and publishes the result through your own node every hour. The reference is the --token-price argument in docker-compose.yml, currently 0.12; at a Big Mac of 6.12 USD that gives the 51 PIXA per PXS the chain shows today.

docker compose logs -f bigmac-feed
# Big Mac = $6.12 (as of 2026-01-…) → 1 PXS = 51.000 PIXA

Keep --token-price in line with the reference the other witnesses use — the status page shows each feed's deviation from the median, and a large one is visible to every voter. When the reference changes, edit the value and reload only that container:

nano docker-compose.yml             # change --token-price=0.12
docker compose up -d bigmac-feed

Nothing here leaves the machine except the signed transaction: the feed talks to hived over the internal Compose network, which is why the witness config loads database_api, condenser_api and network_broadcast_api alongside the witness plugin. If you publish your feed by other means, remove the service.

8API node

On the second server, repeat steps 1 to 3 with the API firewall rules, then give it a name. At your domain registrar, create an A record — for example host api, value your server's IPv4 — and wait until it resolves before you go on. Caddy asks Let's Encrypt for a certificate the moment it starts, and a name that does not yet point at the server produces failed attempts that count against that domain's rate limit.

dig +short api.example.com          # must print your server's IP; nslookup works too

git clone https://github.com/pixagram-blockchain/pixagram-node.git
cd pixagram-node
echo 'SITE_ADDRESS=api.example.com' > .env && chmod 600 .env

HAF ships PostgreSQL tuned for Hive at full scale, with 16 GiB of shared buffers; Postgres refuses to start if it cannot reserve them. On anything under about 24 GB of RAM, override it in the bind-mounted directory before the first start (raise the numbers in proportion on a bigger machine):

mkdir -p pixagram-haf/haf_postgresql_conf.d
cat > pixagram-haf/haf_postgresql_conf.d/local.conf <<'EOF'
shared_buffers = 2GB
effective_cache_size = 4GB
maintenance_work_mem = 512MB
EOF
docker compose up -d
docker compose logs -f pixagram_haf

The first start pulls about 750 MB of images, then syncs the chain twice — hived and the HAF hived — and indexes it into PostgreSQL and Hivemind. The one-shot hivemind_setup container must finish (exit code 0) before hivemind_sync and hivemind start; give it a few minutes and do not restart the stack while it runs. Jussi may flap for up to a minute after any cold start because it resolves Hivemind's address when it loads — that is normal.

Verify the chain layer and the social layer, then compare head_block_number with api.pixagram.com:

curl -s -X POST https://api.example.com -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"condenser_api.get_dynamic_global_properties","params":[],"id":1}'

curl -s -X POST https://api.example.com -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","method":"bridge.get_ranked_posts","params":{"sort":"created","tag":"","limit":1},"id":1}'

Once it serves, put the address on your witness page and tell the Pixagram team so it can be listed for the app. If your provider or a CDN offers a filtering proxy for HTTPS, you can put the API behind it; the peer ports stay on the server's own address.