Set up your hub

The hub is the private relay at the center of the C3 suite. One hub serves both products: C3 Mobile control traffic and C3Sync session sync ride the same server in isolated NATS accounts. You set it up once.

TIP — > On Linux, C3 Desktop can run this flow as a guided setup on the current machine or on another machine over SSH. See guided hub setup. The commands below remain the CLI reference.

NOTE — > This is the canonical hub guide for the whole suite. If you already run a C3Sync hub, you can skip initialization — just make sure it was created with a recent c3sync version so the WebSocket listener for phones (port 8443) exists, then continue to bridge setup.

1. Initialize

On the machine that will host the hub, with the c3sync CLI installed:

c3sync hub init --handle you@example.com --host hub.example.com

• --handle — your identity across the suite.
• --host — the address bridges and phones will reach the hub at (a LAN name, a VPN/overlay address, or a public DNS name). The TLS certificate is bound to it.
• Defaults: TLS 1.3 on 0.0.0.0:4222 (--listen), pinned WebSocket on 0.0.0.0:8443 (--ws-listen), hub files in ~/.c3sync/hub (--dir).

This creates the dual-account NATS operator, a local P-256 certificate authority, and the serving certificate. It prints the CA pin — the stable trust anchor that C3Sync devices, phones, and bridges all verify. Enrollment QR codes and bundles carry it for you; you rarely need to copy it by hand.

2. Back up the administration keys

Do this immediately, before enrolling anything:

c3sync hub control backup --out c3-hub-backup.sealed

The sealed backup (passphrase-encrypted) is the only way to recover hub administration if this machine dies. Keep it offline, separate from its passphrase, and re-export after any revocation or certificate ceremony. Recovery uses c3sync hub restore.

3. Run it

For a quick test, run in the foreground:

c3sync hub run

For real use, install it as a background service that starts at boot and restarts on failure:

c3sync hub install
c3sync hub status

4. Verify

Use C3 Desktop's hub status or connect an enrolled client from the same network path. A successful pinned WebSocket connection confirms port 8443 is reachable; a bridge or C3Sync device connecting is the real test for port 4222.

Moving or mirroring the hub

The hub's serving files are portable. c3sync hub export packs nats.conf, the public operator JWT, and the TLS serving files — never device registries, signing seeds, or message data — into an archive that c3sync hub import unpacks on another machine. Administration (enrollment, revocation, backups) stays with the keystore on the machine that ran hub init, or wherever you hub restore a sealed backup.

Next: set up a bridge on each machine you want to control.