Install on Linux

On a Linux computer with systemd (x86_64 or arm64), run this command.

curl -fsSL https://download.thenifty.app/stable/install.sh | sudo sh

The installer asks how you'll reach Nifty, shows its plan and asks Continue? before it changes anything. When Nifty is running, the installer prints a one-time setup link. Open the link, type your name and choose whether to Send error reports (Error reports and privacy). Nifty then welcomes you: choose your username and password, then your details, colours and backups, and start the free trial or add your licence key (Setting up Nifty).

To see what the computer needs, read Requirements.

Choose how you'll reach Nifty

Answer	Flag	More
Over Tailscale	--tailscale	Tailscale
At a domain, with a free Let's Encrypt certificate	--letsencrypt DOMAIN	HTTPS
… when the internet can't reach this machine	--letsencrypt DOMAIN --dns cloudflare	HTTPS
At a domain, with a certificate I already have	--tls-cert FILE --tls-key FILE --origin URL	HTTPS
Through my own proxy	--origin URL	Behind a proxy
Only from this machine	--local	http://127.0.0.1:4000

Tailscale is offered first when it's running on the computer.

Install without questions

Pass the answers as flags, and add --yes to skip Continue?. Flags are required when there's no terminal, such as in a provisioning script.

curl -fsSL https://download.thenifty.app/stable/install.sh | sudo sh -s -- --letsencrypt notes.example.com --yes

Flag	Does
--no-tailscale-operator	With --tailscale: run tailscale serve once instead of letting Nifty manage it (why)
--letsencrypt-staging	With --letsencrypt: use Let's Encrypt's staging server, for trials (browsers won't trust it)
--listen HOST:PORT	With your own proxy: where Nifty listens (default 127.0.0.1:4000)
--trusted-proxies LIST	With your own proxy: proxies whose X-Forwarded-For to believe (default 127.0.0.1)
--yes	Don't ask Continue?

curl -fsSL https://download.thenifty.app/stable/install.sh | sh -s -- --help lists all the flags. For Cloudflare, pass the API token in CLOUDFLARE_API_TOKEN, never as a flag. For example, run curl … | sudo --preserve-env=CLOUDFLARE_API_TOKEN sh -s -- …. If you don't, the script asks for the token without showing what you type.

What it installs

Path	What
/usr/local/bin/nifty	The program
/var/lib/nifty	Your data: encrypt it
/var/lib/nifty-backups	Backups: copy them off the machine
/etc/nifty.env	Settings (root:nifty, mode 640)
nifty.service	The service, run as the nifty user
/etc/systemd/system/nifty.service.d/ports.conf	Only when Nifty serves HTTPS itself: lets it use ports 443 and 80

The installer checks the download against SHA256SUMS. If minisign is installed, it also checks that file's signature.

Change a setting

Edit /etc/nifty.env, and then restart Nifty.

sudo systemctl restart nifty

Every setting is listed in Configuration. Running install.sh again keeps the program, settings and data, and ignores any flags you pass.

The beta channel

To get beta releases, install from https://download.thenifty.app/beta/install.sh. The server stays on the beta channel until you change it. See Updates and channels.

Check on it

systemctl status nifty
journalctl -u nifty -f

If it doesn't start

• Waiting for systemd to report the network online: systemd waits for network-online.target before it starts Nifty, which takes minutes on some computers. Nifty starts when the wait is over.
• Let's Encrypt fails: The script stops and says why, and when Nifty will try again. See HTTPS.
• Anything else: journalctl -u nifty -n 50 says why. Fix /etc/nifty.env, and then run sudo systemctl restart nifty.