A server

A computer that’s always on is the best place for copies of your files: it keeps them while your phone is off, and makes the thumbnails for your photos. It doesn’t need a desktop. The iceblock command is Iceblock without its window.

Install it

On Ubuntu 22.04 or Debian 12, or newer, add Iceblock’s package repository, then install the iceblock package:

sudo curl -fsSL https://git.tricauda.com/api/packages/iceblock/debian/repository.key -o /etc/apt/keyrings/iceblock.asc
echo "deb [signed-by=/etc/apt/keyrings/iceblock.asc] https://git.tricauda.com/api/packages/iceblock/debian stable main" | sudo tee /etc/apt/sources.list.d/iceblock.list
sudo apt update && sudo apt install iceblock

It brings nothing graphical. apt keeps it up to date. To mount your files as a folder, it needs fuse3, which apt installs with it unless you ask it not to.

On NixOS, the repository’s nix/ has packages for the command line, diagnostics and the app, and a module that runs iceblock serve for the users you name (services.iceblock): see nix/README.md there.

Join your network

On a device already in your network, go to Devices, then Add a device, then Show an invitation, and copy its link. On the server, run:

iceblock join '<the link>'

Then approve it on that device, as for any other.

A device joining through the server asks to be let in there. Run as a service, the server has nobody to ask, so it waits for an answer for a few minutes: every one of your devices that can let devices in shows a notice, or answer on the server itself:

iceblock join-asks
iceblock join-answer <id> full

Check the fingerprint join-asks shows matches the one on the joining device. Instead of full, metadata-only, storage or app let it in at that trust, and no declines it.

Confirming it’s you

Changes to your network (letting a device in, removing one, changing its trust, giving a Collection away) ask for your password first, through polkit, as the iceblock package sets up: in the terminal where you typed the command, or in your desktop’s prompt from the app. A script, or anything else with no terminal and no desktop, can’t make those changes. Without polkit (installing from the .tar.gz, or with Nix outside NixOS), they’re confirmed as before.

Keep it running

iceblock serve runs Iceblock until it’s stopped. The package brings a service that runs it for you. Turn it on as the user Iceblock is for:

systemctl --user enable --now iceblock

On a server nobody logs into, also let that user’s services run without a login:

sudo loginctl enable-linger $USER

journalctl --user -u iceblock shows what it’s doing.

The iceblock command

iceblock on its own lists its commands. Some useful ones:

iceblock status: how this device and your network stand: serving, its relay and port forward, the devices heard from, storage, and how many files are less safe than they ask (--at-risk lists them, --files every file).
iceblock ls [-lhR] [path], as ls: what’s in a folder, a Collection by its name (iceblock ls Photos/2026), --trash and --versions too; iceblock add [-t <folder>] <files or folders>, iceblock read <name> -o <file>: files. Tab completes paths in Iceblock for these.
iceblock consume [-t <folder>] <files or folders>: takes them in, then deletes the originals once your other devices keep them safe (--now deletes them as soon as they’re taken in).
iceblock notices: anything that needs you.
iceblock whoami: this device, and its network.

Tab completes its commands in bash, zsh and fish, as the package installs that (open a new shell after installing). Elsewhere, iceblock completions bash (or zsh, fish) prints the script to install by hand.

While Iceblock is running, a command goes to it and runs there, as the device can be opened by one program at a time. That works on a desktop too, where the app runs it. There, a command that could share your files or let someone into your network shows in the app first, naming the program that sent it, and runs only if you allow it. Allow the iceblock command, in the menu on the Devices tab, turns this off.

The command and the app use the same device, kept in ~/.local/share/com.tricauda.iceblock/device unless you choose otherwise. Back it up with care: whoever has its keys has the device.

Where its data is

To keep the device somewhere else, such as on a bigger disk:

iceblock config data-dir /srv/iceblock --migrate

--migrate moves the device there. If Iceblock is running it as a service (iceblock or, on a desktop, iceblock-gui), that’s stopped first, then started again once it’s moved. Without --migrate, it only says where to look from now on, which is what you want if a device is already there.

The choice is kept in ~/.config/iceblock/data-dir, and the command and the app on a Linux desktop both follow it. iceblock config shows where the device is, and why. ICEBLOCK_DATA_DIR, if it’s set, overrides both.