Flagship

You're stuck. Here's what to try first.

Quick fixes for the four problems we see most often. If none of these unstick you, scroll to the bottom and email a real human.

Quick start

I just want to start.

  1. Install the phone app from /download (or use the web app).
  2. On a computer, install Flagship Studio.
  3. Create a server in the app, pair with Studio's QR or short code, then use Studio to write the installer USB (8 GB+).
  4. When the server first asks to be approved, check that the six-digit code on its screen matches the one in the app, then approve.

About ten minutes to a real green padlock at you.flagship.services.

Stuck on install

I'm stuck on the install screen.

  1. "No pairing code accepted": reopen Studio to show a fresh QR and short code, then try again.
  2. "No network": the installer needs DHCP on a wired ethernet port. Wi-Fi is not supported during install. Plug a cable in.
  3. "Disk too small": minimum is 32 GB. The installer formats whichever disk you point it at; it does not dual-boot.
  4. The six-digit codes don't match: don't approve. The server on your screen is not the one your phone is talking to. Delete the server in the app and create it again from a new recipe.

Still stuck? Capture the screen and email it.

Phone trouble

My phone died.

  1. If you set up cloud recovery, sign in on the new phone with your account name. It asks for your passkey (kept by iCloud Keychain or Google Password Manager) and your recovery passphrase.
  2. No cloud recovery? Use another device that is still signed in, or your saved account key file. With none of these your account can't be recovered; that's by design (we have no backdoor) and we tried to be clear about it during setup.
  3. The hardware itself is fine. Spinning up a new account against the same box is a clean reinstall.

Full recovery flow: /docs/recovery.

Service not loading

A service isn't loading.

  1. Browser shows "DNS error": your subdomain is propagating. Wait 60 seconds; check /status.
  2. "Cert invalid" / no green padlock: the daemon is renewing. Check the dashboard for "Renewing" pill; usually clears in 90 seconds.
  3. "403 not a member": the service is identity-gated and your phone hasn't approved your device. Approve from the phone, refresh.

Your server's recent events are under Activity in the app.

A bit more, by symptom.

Three things that can knock a working install offline. Each one resolves on its own most of the time; if it doesn't, here's where to look.

My install is stuck at "installed"

The install finished and the box powered off so you could unplug the USB stick and power it back on, but after you do, it never comes up. This almost always means the box can't reach the network early in boot, so it can't fetch the key that unlocks its encrypted disk. It's the usual symptom on a Wi-Fi-only box (the disk-unlock step runs before Wi-Fi is available). Two fixes:

  1. Plug in an Ethernet cable. A wired connection is up early enough for the box to fetch its unlock key and finish booting. This is the simplest fix and keeps your disk encrypted.
  2. Or create a new server with disk encryption turned off. In the app's "Create a server" screen (or the web app), uncheck Encrypt disk, then re-burn. A box with the disk unencrypted boots without needing the network to unlock, so it works on Wi-Fi-only setups. The trade-off: your data is no longer encrypted at rest, which is less safe if the box is stolen. Choose this only when a wired connection isn't an option.

The dashboard says "Offline"

The tunnel from your box to flagship.services is down. Check, in order:

  1. Power and network. Is the box on? Is the cable in? Can it reach the internet (ping 1.1.1.1)?
  2. Outbound 443 reachable. Some restrictive networks block long-lived WebSockets. curl https://flagship.services/api/health from the box should return JSON.
  3. Daemon health. Restart the server from its page in the app. If you turned on debug access (an SSH key you add from the server's page, for a limited time), you can SSH in and run systemctl status flagship; recent logs are in journalctl -u flagship -n 200.

"This server's key changed"

Your phone keeps each server's own key from the first time you approved it. This message means the server now presents a different key. If you did not rebuild the server, do not approve anything for it: someone else may be answering in its place. If you did rebuild it, create it again from the app with a new recipe, so your phone meets its new key the normal way.

flagshipserver.com is down, and I need my server

Open the iPhone or Android app on the same Wi-Fi as your server. The app finds the server on your home network and checks its key, so you can still:

  1. See its status and its apps.
  2. Start, stop or restart an app, or restart or shut down the server.
  3. Make a backup and save it to your phone.

This works only while the server is running. Don't restart it unless you have to: a server that restarts needs flagshipserver.com to unlock its disk.

"Cert invalid" in the browser

Your TLS cert lives on the daemon and renews automatically 30 days before expiry. If you're seeing a cert warning:

  1. Wait 90 seconds. Renewals re-issue and reload silently. The dashboard shows a "Renewing" pill while it's happening.
  2. Check the dashboard's cert section. If it says "Failed", the underlying cause is in the daemon log. The most common reason: the box was offline during the renewal window. Triggering a manual renewal from the dashboard fixes it.
  3. Brand-new install with no cert at all: the first issuance happens at boot and takes 30 to 60 seconds. Refresh.

"403 not a member" or "Service locked"

Services default to identity-gated: only the owner and explicitly invited users can hit them. If you're the owner and seeing 403:

  1. Confirm you're signed in on this device. Open the dashboard at https://you.flagship.services/.flagship/; if it asks for pairing, pair.
  2. If you're a guest someone shared the service with: ask them to re-issue the invite. Invite tokens expire after first use.
  3. If the service is supposed to be public, check its manifest's access field. Owner can change it from the dashboard.

How do I delete my Flagship account?

You delete your account yourself, in the Flagship app on iPhone, iPad or Android, or in the web app. It can't be undone.

  1. Open Flagship on a device that is signed in to the account and go to Settings, then tap Delete account.
  2. If other devices are still signed in, remove them first in Settings, Trusted devices.
  3. Type your username to confirm, choose whether to also ask your servers to delete their content, and tap Delete my account forever.

What is deleted: your username and public keys within 30 days (a key's fingerprint may stay on revocation lists), your voi.ci page at once, and the messages waiting for you with the account. Your servers stop being reachable and you can no longer manage them; to keep one, transfer it to another account first. Copies on your own devices stay until you delete them. You can also mail privacy@flagship.services to have us delete your account and data; we do it within 30 days.

I want to talk to a human.

A real person reads every email. Mail support@flagshipserver.com with what you tried, what you saw, and the dashboard URL or device path. Replies usually within a day, faster if you mention "blocked".

Live

If /status shows green and you're still broken, that's almost always something local, and that's almost always something we can help with by email.