The Ark Vault

Air-gapped local replica of ManyArks.earth. A single-board computer serving the full site — every domain, every rig, every manifest, every sequence, every echo — over a local WiFi hotspot. Never connects to the internet, ever. Updates arrive on physical media, are verified, then are loaded by hand. Where The Ark Mirror prioritizes freshness, The Ark Vault prioritizes integrity. It is the version of ManyArks that cannot be reached, cannot be poisoned, and cannot be silently changed.

Footprint Paperback-sizedDedicated shelf or inside The Vault (#35), permanently powered or stored ready Yield Full site offlineAll domains, rigs, manifests, sequences, echoes, lexicon, fixed in time at last verified update Cycle Manual updateSneakernet only, no automatic sync, ever

Cost tier starterDifficulty weekendLand noneFirst benefit ~1 day

② The Manifest

The parts list. Cores are what you actually need; “if you prefer” opens cheaper, local, or heritage swaps — never budget fallbacks, just other good ways.

Computer

Raspberry Pi 4 Model B (2GB RAM)~$45

More than sufficient to serve a static site. The 2GB model is the sweet spot — 4GB and 8GB offer no benefit for this use case. Widely available, well-documented, massive community.

if you prefer… (2)

Raspberry Pi 5 (2GB)~$60Faster, newer, same form factor. Overkill but future-proof.

Raspberry Pi Zero 2 W~$15Half the size, built-in WiFi, $15. Slower but sufficient for a static site. The smallest possible mirror.

Storage

32GB microSD card (Class 10 / A1 or better)~$8

Holds the OS plus the entire ManyArks static bundle with room to spare. SanDisk Extreme or Samsung EVO are reliable choices. The static site is text, JSON, and lightweight assets — it will fit in a few hundred megabytes.

if you prefer… (1)

64GB or 128GB microSD~$12–18Extra room for future content, echo audio files, or PDF exports.

Case

Aluminum heatsink case (passive cooling, no fan)~$12

The entire case is the heatsink. No moving parts, no fan noise, no fan to fail. Runs cool enough for 24/7 operation in a closet or shelf.

if you prefer… (1)

Argon ONE case~$25Adds power button and full-size HDMI. More polished, slightly more expensive.

Power

USB-C power supply (5V 3A, official Raspberry Pi supply)~$8

Use the official supply or a quality 5V 3A adapter. Unreliable power causes SD card corruption — do not use a random phone charger.

if you prefer… (1)

12V to 5V USB-C buck converter~$8Run from a 12V battery bank or solar system. Integrates with your Power-domain rigs.

WiFi hotspot

Built-in WiFi (Pi 4/5) configured as access point$0 (built-in)

The Pi broadcasts its own WiFi network: connect any phone, tablet, or laptop and browse ManyArks.earth locally. No internet needed. SSID and password of your choosing. Range covers a house or workshop.

if you prefer… (1)

External USB WiFi adapter (high-gain)~$15Better range if the Pi is in a metal building or far from where you need to access it.

Software

Raspberry Pi OS Lite + nginx serving static files$0

Pi OS Lite is headless — no desktop, minimal overhead. nginx serves the static site bundle. hostapd + dnsmasq create the WiFi hotspot. There is no sync script. Updates arrive on USB only, by hand, with checksum verification. All free, all open source.

③ The Sequence

01Flash the Pi (one time, on a separate machine)10 min On a different computer — never the Vault itself — flash Raspberry Pi OS Lite (64-bit) to a microSD card using Raspberry Pi Imager. In the imager settings: enable SSH, set a username and password, and DO NOT configure any WiFi credentials. The Vault must never have a record of any external network. Insert the card into the Pi, connect power, wait 60 seconds for first boot.
02Initial config over a wired connection20 min Connect the Pi to a laptop via Ethernet crossover cable, or to a router that is itself disconnected from the internet. SSH in. Run sudo apt update && sudo apt upgrade -y from a local apt mirror or a one-time isolated network. Install nginx, hostapd, and dnsmasq. Once installed, this is the LAST time the Vault will ever touch a network it does not own.
03Configure the WiFi hotspot only30 min Configure hostapd and dnsmasq to broadcast a WiFi network (e.g., SSID: ArkVault, password of your choosing). Disable wpa_supplicant entirely so the Pi cannot connect to any external WiFi. Disable Ethernet client mode. The Pi can serve a network. It cannot join one. Verify by checking that no wlan0 client mode is configured and no eth0 dhcp client is running.
04Load the initial pressing15 min Prepare the update media on a trusted machine (the protocol is step 06): a clean USB drive holding manyarks-bundle-<date>-pNNN.tar.gz, its .sha256, and nothing else. Plug it into the Vault and verify before you trust it — sha256sum -c manyarks-bundle-<date>-pNNN.tar.gz.sha256. The Vault needs no Node and no network for this; coreutils is enough, which is the point. Only on OK, extract to /var/www/manyarks/, configure nginx to serve from that directory, unmount the USB, and restart nginx. Connect a phone to the ArkVault hotspot and walk the site: the manifesto at the root, then a domain, then a rig. Write the pressing number on the drive before you put it away.
05Lock the device10 min Disable SSH from any interface other than the local hotspot, OR disable SSH entirely after this point — the Vault does not need remote administration. Remove the keyboard if you connected one. The Pi now has exactly two jobs: broadcast its hotspot, serve the static files. Nothing else.
06The update protocol — sneakernetongoing Updates arrive on a dedicated USB drive prepared on a trusted machine. Never over a network, ever. The protocol: (1) on the trusted machine, run the verifier against the new pressing — it checks every file against its recorded sha256, refuses any file not on the manifest, recomputes bundle_sha256 from the manifest, and confirms the chain, because each pressing records the bundle_sha256 of the one before it, so a substituted or silently skipped pressing surfaces as a broken chain instead of a plausible-looking site; (2) write the tarball and its .sha256 to a clean drive; (3) carry the drive to the Vault; (4) mount and run sha256sum -c there, on the Vault itself, with your own eyes; (5) only on match, extract to a staging directory and repoint the nginx root; (6) restart nginx and check the site from a phone; (7) eject, write the pressing number and date on the drive in permanent marker, and store it inside The Vault. If a check fails at any step the bundle is rejected and the Vault keeps serving what it already has. No exceptions. No just this once. A Vault serving a three-year-old verified pressing is doing its job. A Vault serving an unverified fresh one has stopped being a Vault.
07Schedule the disciplineongoing Decide on an update cadence (quarterly is reasonable for a stable site, monthly for an active one) and put it on a recurring calendar. Sneakernet only works if it actually happens. The Ark Vault that has not been updated in three years is still useful — but it is not a substitute for the Mirror. Both rigs serve different threat models.

⑤ The Echo

Why Two Mirrors14 min

The Ark Mirror and the Ark Vault look almost identical — both are Raspberry Pis serving ManyArks.earth over a local WiFi hotspot. The hardware is interchangeable. The software is nearly identical. The only difference is one wire, one config flag, and one discipline. The Mirror connects. The Vault never does. This is not redundancy in the engineering sense, where you build two of a thing in case one fails. This is redundancy across threat models. The Mirror's threat model is 'the internet went down' or 'manyarks.earth was taken offline.' The Mirror's response is to keep serving the most recent version it has. It is fresh, current, and trustworthy as of its last sync — and its last sync might have been an hour ago. The Vault's threat model is different. The Vault assumes that something has gone wrong upstream — that the site that the Mirror is syncing from has been compromised, that an update silently changed a sequence's safety instructions, that the trusted machine that builds the export was itself trusted in error. The Vault will not pull a bad update because the Vault will not pull anything. It accepts updates only from a human who walks into the room with a USB drive and a checksum. This means the Vault is always older than the Mirror. That is the point. The Vault is a snapshot of ManyArks at a moment when you decided to trust it. The Mirror is a stream from a source you mostly trust. Both are useful. Together, they are a check on each other. If the Mirror and the Vault disagree about how to build a rig, you stop and figure out why before you cut the wood.

The Discipline of Sneakernet11 min

Sneakernet — physically carrying data on removable media between machines that are not networked together — sounds primitive. It is. That is its strength. Networks are convenient because they are always on. The same property that makes them convenient makes them attack surfaces. Every always-on network connection is a path inward as well as outward. The Vault has zero of these paths. The only way to put bytes onto the Vault is to carry them in your hand. That hand-carry is also a discipline. It forces you to think about what you are about to put on the Vault. You have to physically prepare the update on a different machine. You have to compute and check a checksum. You have to walk the USB across the room. Each of these steps is a chance to notice that something is off — that the bundle is suspiciously larger than usual, that the checksum tool returned something that doesn't match, that the export script ran without errors but produced a corrupted output. None of these would catch a perfectly executed attack, but they would catch most of them. Most attacks succeed because no one is paying attention. Sneakernet makes you pay attention. Once a quarter, you handle the bytes. You see them. You decide they are worth carrying. The Vault you load is a Vault you trust, because you watched it onto the device. This is the same principle as canning your own tomatoes. You could buy a jar at the store and trust the supply chain that filled it. Or you could be the supply chain. The Vault is you being the supply chain for your family's knowledge.

⑥ Feeds

How this rig connects to the rest of the Ark.

← information The Ark Mirror Ark Mirror exports the verified static bundle that is hand-carried to the Ark Vault — the Mirror is the upstream source the sneakernet protocol trusts
→ information The Vault The Ark Vault's microSD card and the dated update USBs live inside The Vault when not in active use — physical custody of the air-gapped device and its media
← energy The Sun Bank The Ark Vault draws under 5W; a small solar panel and battery keep it serving knowledge indefinitely off-grid, with no power-grid dependency to compromise its isolation
← community The Whisper Node Meshtastic mesh announces the Ark Vault WiFi hotspot availability to nearby nodes — other Arks can connect and access the air-gapped knowledge base, even if every other system in the property is down
→ material The Vault Media IN from The Ark Vault (52): the air-gapped single-board computer and its microSD, plus the dated USB sticks of each Pressing, come to rest inside the safe. The Ark Vault produces the archive; the Vault is the body that keeps it alive.
← information The Vault Refresh signal OUT to The Ark Vault (52): the annual verify-and-re-Press cadence tells the Ark Vault when flash media needs re-burning and a new Pressing is due, closing the loop so the archive never quietly rots in the dark.
← information The Charter A signed paper copy of the charter is preserved in the Ark Vault so its decision process survives a long grid-down emergency intact.

Signal · The Ark Vault · signal/ark-vault Offline? Same path on any Ark Mirror.