The hub

The hub is the program pbx-hub on a server in your Hetzner project. It holds the desired state of your hosts and twins in one SQLite file and talks to the Hetzner API with your tokens.

What pbx up creates

Everything carries the labels pbx-managed=true and pbx-hub=<name>.

Resource	What it is
Server	the hub’s server, 1 vCPU and 1 GB by default (cpx02; --server-type takes a larger one)
Image	a snapshot of PaaSbox’s Podman image, also used for your hosts
Network	a private network, 10.80.0.0/16; hosts reach the hub on its private address
Firewall	UDP 51820 for WireGuard; TCP 22 only from your address and only while pbx up or pbx upgrade runs
Primary IPv4	kept when the server is replaced, so hosts and twins find the hub again after a restore

pbx up shows this list and asks before it creates anything. A step that finds its resource takes it, so an interrupted run continues.

How the hub is reached

Who	Through	Proof
Your devices (pbx, the portal, the API)	a WireGuard tunnel only; nothing of it listens on a public address	each request is signed by a paired device
Hosts’ agents	the private network	each request is signed by the agent’s key
Twins’ agents	the hub’s public address, opened in the firewall to each live twin only	the same signatures
PaaSbox	outbound only: the licence check and signed releases	the licence key

The tunnel runs inside the pbx process; there is no standing tunnel and no daemon. While pbx open runs, it shares its tunnel with the other pbx commands you run on that machine for the same hub, so a second command does not take the open portal’s session over. Each command still signs its own requests. pbx status shows whether a pbx open holds the link. Not on Windows; PBX_LINK_SHARE=off turns it off for a run.

What it stores

The SQLite file holds your hosts, twins, devices, keys, approvals and the audit log. Your Hetzner tokens and other secrets are encrypted with the hub’s data keys. The offline recovery key, shown once by pbx up, is the way back to them if the hub’s server is lost.

Backup and restore

The hub replicates its database continuously to your S3 bucket (Litestream). If the server is lost, a new server restores it from the bucket with the recovery key; the hosts carry on without enrolling again.

Measured in a lab on 20 October 2026, with the hub on a 1 GB server, 3 hosts and a twin: no data lost, the restore and start in 4.3 seconds, the hosts back 112 seconds after the restore began. The hub used 66 MB of memory in the median and 126 MB at most.

Upgrade and remove

• pbx upgrade moves the hub to a newer release. Port 22 opens to your address for the run and closes after it.
• pbx down removes the hub and what pbx up created. It refuses while the hub still manages a host, deactivates the licence, and asks you to type the hub’s name.