---
title: Deploy Pinchy on DigitalOcean
description: Deploy a self-hosted AI agent platform on DigitalOcean. Step-by-step guide from Droplet creation to running Pinchy with Docker.
---

import { Aside, Code, Steps } from "@astrojs/starlight/components";
import cloudInitScript from "../../../snippets/cloud-init.yml?raw";

DigitalOcean is a solid choice for running Pinchy — straightforward interface, predictable pricing, and data centers on multiple continents. If your team is distributed or you want to keep your AI agents close to your users, DigitalOcean's global footprint makes that easy.

## Why DigitalOcean for self-hosted AI agents?

- **Global data centers** — New York, San Francisco, London, Amsterdam, Frankfurt, Singapore, Bangalore, Sydney, and more. Pick the region closest to your team.
- **Simple pricing** — A Droplet with 4 GB RAM starts at around $24/month with predictable costs.
- **Team accounts** — Built-in team management for sharing infrastructure access.

<Aside type="tip">
  On a budget? [Hetzner Cloud](/guides/deploy-hetzner/) offers comparable
  servers starting at €4.50/month — about a fifth of the cost — with faster boot
  times and EU data centers.
</Aside>

## What you'll need

- A [DigitalOcean account](https://cloud.digitalocean.com/registrations/new) (free to create, pay-as-you-go)
- A domain name (optional for testing, required for production HTTPS)
- An LLM provider API key (Anthropic, OpenAI, or Google) — you'll enter this in Pinchy's setup wizard

## Create your Droplet

A "Droplet" is DigitalOcean's name for a virtual server.

<Steps>

1.  **Log in to the [DigitalOcean Control Panel](https://cloud.digitalocean.com/)**

    Click **Create → Droplets**.

2.  **Choose a region**

    Pick the datacenter closest to you or your users. Pinchy works in any region.

    <Aside type="note">
      For EU data residency requirements, choose a European region like
      **Frankfurt (FRA1)** or **Amsterdam (AMS3)**. Your AI conversations and
      data will stay in the EU.
    </Aside>

3.  **Choose an image**

    Select **Ubuntu** and keep the default version (**24.04 LTS x64**).

4.  **Choose a size**

    Under **Droplet Type**, keep **Basic** (Shared CPU). Under **CPU options**, **Regular** (SSD) is fine. Pick the **$24/mo** plan (4 GB RAM, 2 CPUs).

    <Aside type="tip">
      For teams with more than 5 users or heavy agent workloads, consider the
      $48/mo plan (8 GB RAM, 4 vCPUs) for smoother performance.
    </Aside>

5.  **Choose authentication**

    Select **SSH Key** or **Password**. Either works for the automated setup below — you'll need SSH access later for production hardening.

6.  **Paste the setup script**

    Expand **Advanced Options** and check **Add Initialization scripts (free)**. Paste the following script into the text field. It automatically installs Docker, deploys Pinchy, sets up a firewall, and adds swap.

    <Code code={cloudInitScript} lang="yaml" title="cloud-init.yml" />

7.  **Set the hostname and create the Droplet**

    Under **Finalize Details**, change the hostname to `pinchy` (or whatever you prefer) and click **Create Droplet**. It'll be ready in about 30 seconds, but the setup script needs another **1-2 minutes** to pull the Pinchy images.

8.  **Note the IP address**

    The Droplet's IPv4 address appears on the dashboard (e.g., `164.90.x.x`).

9.  **Open Pinchy**

    Visit `http://<your-droplet-ip>` in your browser. You'll see a loading page that tracks the installation progress. Once the images are pulled (typically 1-2 minutes), it automatically redirects to the Pinchy setup wizard.

    The setup wizard will guide you through creating your admin account and configuring your first LLM provider.

</Steps>

## Production setup

The steps above get Pinchy running over plain HTTP. The cloud-init script already pinned your secrets (`DB_PASSWORD`, `BETTER_AUTH_SECRET`, `ENCRYPTION_KEY`) in `/opt/pinchy/.env` and installed Caddy as a reverse proxy.

To enable HTTPS, follow the [HTTPS setup steps in the Hetzner guide](/guides/deploy-hetzner/#set-up-https-with-caddy) — the cloud-init flow is identical: edit `/etc/caddy/Caddyfile`, replace `:80` with your domain, and reload Caddy. Let's Encrypt is automatic.

See the [VPS Deployment Guide — Production setup](/guides/vps-deployment/#production-setup) for further hardening (domain lock, automatic security updates).

<details>
<summary>How do I connect to my Droplet to run these commands?</summary>

You'll need to use **SSH** (Secure Shell) — a way to run commands on a remote server from your terminal.

If you chose password authentication when creating the Droplet:

```bash
ssh root@<your-droplet-ip>
```

Enter the password you set (or check your email for the one DigitalOcean generated).

If you chose SSH key authentication, make sure you have the key on your machine, then:

```bash
ssh root@<your-droplet-ip>
```

**Where do I find the terminal?**

- **Mac** — Open **Terminal** (search for it in Spotlight with ⌘+Space)
- **Windows** — Open **PowerShell** (search in Start menu) or install [Windows Terminal](https://aka.ms/terminal)
- **Linux** — Open your terminal app (usually Ctrl+Alt+T)

While connected, every command you type runs on your Droplet. Type `exit` to disconnect.

</details>

## Point your domain (optional but recommended)

To use HTTPS, you need a domain pointing to your Droplet. Add a DNS record at your domain registrar (the service where you registered your domain):

| Type | Name                                   | Value                     |
| ---- | -------------------------------------- | ------------------------- |
| A    | `pinchy` (or your preferred subdomain) | Your Droplet's IP address |

<details>
<summary>What's an A record?</summary>

An A record is a DNS entry that maps a domain name (like `pinchy.example.com`) to an IP address (like `164.90.1.23`). When someone visits your domain, their browser looks up the A record to find your server.

Look for "DNS records" or "DNS settings" in your domain registrar's dashboard.

</details>

You can also manage DNS directly in DigitalOcean under **Networking → Domains**.

## DigitalOcean-specific tips

### Enable backups

DigitalOcean offers automated weekly backups for 20% of the Droplet cost. Enable this under **Droplet → Backups** — it's the easiest disaster recovery option.

### Cloud firewall

DigitalOcean offers **Cloud Firewalls** under **Networking → Firewalls**. For defense in depth, configure the cloud firewall to only allow ports 22, 80, and 443 — in addition to the host firewall (`ufw`) that the setup script already configured.

### Volumes for persistent data

For larger Knowledge Base deployments, attach a DigitalOcean Volume (up to 16 TB) and mount it as a data directory. See [Mount Data Directories](/guides/mount-data-directories/) for details.

### Scaling up

If you outgrow the 4 GB Droplet, you can resize it in the control panel. Pinchy's data lives in Docker volumes, so it survives Droplet resizes. Power off the Droplet first, resize, then power back on — downtime is typically under 2 minutes.
