> ## Documentation Index
> Fetch the complete documentation index at: https://docs.phone.wixzel.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Self-hosting
> Running Wixzel Phone on your own server.
A self-host license runs all of Wixzel Phone on a server you control: the API,
the MCP server, the console and the SIP stack. Calls, recordings and transcripts
stay on your infrastructure, and you pay your voice providers directly instead
of buying prepaid credit.
The license costs \$499, paid once, and includes every future release. Buy it
from **Self-host** in the console at
[phone.wixzel.com](https://phone.wixzel.com/self-host).
The license covers your own business. Install it on as many servers as you
need, for your own staff. You may not host it as a service for other businesses
or pass on the software or its source. The full terms are at
[phone.wixzel.com/self-host-license](https://phone.wixzel.com/self-host-license).
## What you need
* **A server** running Ubuntu 22.04 or 24.04 on x86\_64, with 2 vCPUs, 4 GB of
memory, 20 GB of free disk and a public IPv4 address. Use a server with
nothing else on it: Wixzel Phone needs ports 80, 443, 5090 and 8088.
* **A domain** you can add DNS records to.
* **A SIP trunk** from a carrier, as on the hosted platform. See
[SIP trunks](/sip-trunks).
* **Accounts with the voice providers** you want to use. You add their keys in
the console after the install.
## DNS
Choose the address your console will have, such as `phone.example.com`. The API
and the MCP server always sit beside it, so add three A records:
| Name | Type | Points to |
| ----------------------- | ---- | --------------------------------- |
| `phone.example.com` | A | Your server's public IPv4 address |
| `api.phone.example.com` | A | Your server's public IPv4 address |
| `mcp.phone.example.com` | A | Your server's public IPv4 address |
If your DNS host offers a proxy, such as Cloudflare's, turn it off for all
three. The installer checks that each name points at the server before it asks
Let's Encrypt for certificates, and waits up to ten minutes for new records.
The console signs in through the API, so the two must share a domain you
control. That is why they are always `phone.example.com` and
`api.phone.example.com`, and why shared hostnames such as `*.duckdns.org` do
not work.
## Installing
Sign in at phone.wixzel.com and open **Self-host**. Enter the console address
and an email for certificate notices, then choose how the installer reaches the
server.
**Connect over SSH.** Enter the server's address, the SSH user, and a password
or private key. The installer connects once, checks the server and starts the
install, then disconnects. It does not keep the password or key.
**Run a command myself.** You get a command to paste into a terminal on the
server. It works for 24 hours.
```bash theme={null}
curl -fsSL https://api.phone.wixzel.com/self-host/bootstrap.sh | sudo bash -s -- wxi_...
```
Either way the install takes 10 to 20 minutes and runs on the server as a
systemd service, so closing the browser or the terminal does not stop it. The
install page on phone.wixzel.com shows each step and the log. On the server:
```bash theme={null}
sudo journalctl -fu wixzel-install-
```
If an install fails, the page says which step and why. Fix the cause and start
it again. Running the installer again is safe: it keeps everything already done.
## First sign-in
When the install finishes, the install page shows a **setup code**. Open your
console, enter the code, and create the owner account. The code works for seven
days. If you lose it before the owner account exists, make a new one on the
server:
```bash theme={null}
sudo wixzel-phone setup-code
```
Then, in your console:
1. Add provider keys under **Admin**, **Providers**.
2. Add logins for your team under **Admin**, **Users**. A self-hosted server
has no public signup.
3. Connect your SIP trunk, as described in [SIP trunks](/sip-trunks), using
your own server's address.
## Firewall
The installer configures the server's own firewall. If your cloud provider has
a firewall in front of the server as well, allow these there:
| Port | Protocol | For |
| -------------------- | -------- | ------------------------------------------------------------ |
| 22, or your SSH port | TCP | SSH |
| 80 and 443 | TCP | The console, the API, the MCP server and certificate renewal |
| 5090 | UDP | SIP |
| 5091 | TCP | SIP |
| 10000 to 30000 | UDP | Call audio |
## Updates
Open **Self-host** on phone.wixzel.com and run the installer again with the
same console address. It sees the existing install and updates it; data, keys
and settings stay as they are. It first waits up to ten minutes for calls in
progress to end, unless you tick the option not to. If the new release does not
start, the server goes back to the release it was running.
**Admin**, **System** in your console shows when a newer release is out. The
server itself never contacts phone.wixzel.com; the check runs in your browser.
## What calls cost
A self-hosted server bills nobody. A call is never refused or cut off for
credit, and each one still records what it cost at your providers' prices.
**Usage** in the console shows the totals.
## Everyday commands
| Command | What it does |
| ------------------------------ | ------------------------------------------------------------------------ |
| `sudo wixzel-phone status` | Shows whether the API, the billing worker and the MCP server are running |
| `sudo wixzel-phone logs api` | Follows the API's log. Also `billing` and `mcp` |
| `sudo wixzel-phone restart` | Restarts all three |
| `sudo wixzel-phone setup-code` | Makes a new setup code, while the server has no owner |
| `sudo wixzel-phone version` | Prints the release the server runs |
## Installing by hand
**Self-host**, **Downloads** has the server release, the source code and their
SHA-256 checksums. To install without phone.wixzel.com, unpack the server
release on the server and follow `infra/selfhost/README.md` inside it.