The Moshpit network

Connect to Moshpit

Searching Moshpit names works on pit.world with nothing installed. To open them, so that https://chovy.hacker loads like any site, your device needs two things:

1. A resolver that knows Moshpit names. Ordinary DNS has never heard of .hacker. Moshpit's resolver at https://dns.moshcode.sh/dns-query answers Moshpit names and every normal domain, so it can be your only DNS.
2. Trust in the Moshpit Root CA. The registry signs a real certificate for every name, under its own root. Until your device trusts that root, Moshpit sites open with a certificate warning.

Pick the method that fits your device. Each one says which of the two it covers.

1. moshcode (Linux, the whole machine)

The most complete setup: every app on the machine resolves Moshpit names, a local proxy handles HTTPS, and the root is trusted for you. Ordinary domains keep resolving the way they did before.

1. Install moshcode:

   curl -fsSL https://moshcoding.com/install.sh | sh

2. Turn on Moshpit names. It asks for your password once, because it changes system DNS routing and the trust store. Run it as yourself; do not put sudo in front:

   moshcode dns enable

3. Check it:

   moshcode dns status
   curl -I https://chovy.hacker

4. Already installed? Update first, then enable again:

   moshcode update
   moshcode dns enable

Undo everything with moshcode dns disable. To trust the root without changing DNS, use moshcode dns ca.

2. TronBrowser (Linux, one browser)

A privacy browser that carries the Moshpit root and a one-click switch. Nothing on the rest of the machine changes.

1. Install it:

   curl -fsSL https://tronbrowser.dev/install.sh | sh

2. Start it with tron.
3. Open the sidebar and click 🤘 Pit. Moshpit names now open in TronBrowser, and normal sites still go direct.
4. Visit https://chovy.hacker to check.

The Pit and Tor are exclusive: turning one on turns the other off, so Tor lookups never leak. Already installed? Run tron upgrade first. More at tronbrowser.dev.

3. Browser secure DNS (any OS, nothing to install)

Point your browser's DNS-over-HTTPS setting at Moshpit. Only that browser changes. Then install the root so Moshpit sites open without a warning.

Chrome, Edge, Brave, Vivaldi, Opera (desktop and Android)

1. Open Settings → Privacy and security → Security. (Edge: Settings → Privacy, search, and services → Security.)
2. Turn on Use secure DNS.
3. Choose With: Custom (or Add custom DNS service provider).
4. Enter:

   https://dns.moshcode.sh/dns-query

Firefox (desktop)

1. Open Settings → Privacy & Security and scroll to DNS over HTTPS.
2. Choose Max Protection.
3. Under Choose provider, pick Custom and enter:

   https://dns.moshcode.sh/dns-query

Firefox (Android)

1. Open Settings → DNS over HTTPS.
2. Choose Max Protection, then Custom, and enter the same address.

4. Apple profile (iPhone, iPad, Mac)

One download sets the Moshpit resolver for the whole device and carries the root certificate with it.

iPhone and iPad

1. Open this page in Safari and tap Download the Moshpit profile. Tap Allow.
2. Open Settings. Tap Profile Downloaded near the top (or General → VPN & Device Management), then Install and enter your passcode. It says "Not Verified" because the profile is not signed; the contents are what this page describes.
3. Turn on the root: Settings → General → About → Certificate Trust Settings, switch on Moshpit Root CA. iOS asks for this extra step for every root you add yourself.
4. Check it in Settings → General → VPN & Device Management → DNS: Moshpit should be selected. Then open https://chovy.hacker in Safari.

Mac

1. Download the Moshpit profile.
2. Open System Settings → General → Device Management (older macOS: Privacy & Security → Profiles), double-click Moshpit network and choose Install.
3. If Safari or Chrome still warns, open Keychain Access, find Moshpit Root CA under System, open Trust and set When using this certificate to Always Trust.

Remove it any time from the same Device Management screen.

5. Windows 11 (the whole machine)

1. Open Settings → Network & internet, then Wi-Fi or Ethernet, then your connection's Hardware properties.
2. Next to DNS server assignment, click Edit and choose Manual.
3. Turn on IPv4. Set Preferred DNS to 23.95.228.174.
4. Set DNS over HTTPS to On (manual template) and enter:

   https://dns.moshcode.sh/dns-query

5. Leave Fallback to plaintext off, and Save.
6. Install the root.

Undo by setting DNS server assignment back to Automatic (DHCP).

6. Android

Android's system-wide Private DNS setting speaks DNS-over-TLS, which Moshpit does not offer yet. Use your browser's secure DNS instead, which covers browsing:

1. In Chrome or Firefox, follow the browser steps above.
2. Download the Moshpit root.
3. Open Settings → Security & privacy → More security settings → Encryption & credentials → Install a certificate → CA certificate (the words differ a little between phone makers; search Settings for "CA certificate"), tap Install anyway and pick the file.
4. Chrome trusts certificates installed this way. Firefox needs one more switch: Settings → About Firefox, tap the logo five times, then go back to Settings → Secret Settings and turn on Use third party CA certificates.

Trust the Moshpit Root CA

Download it here, moshpit-root-ca.crt, or from the registry at https://pit.moshcode.sh/api/moshpit/ca.crt. Check the fingerprint before you trust it:

openssl x509 -in moshpit-root-ca.crt -noout -subject -fingerprint -sha256

It must say CN = Moshpit Root CA, O = Moshpit and SHA-256 4A:57:66:EC:8C:1F:10:F8:75:C9:89:65:FB:E8:DC:36:1A:32:C7:2B:C3:95:95:16:EA:7B:81:61:00:1E:15:57.

What you are trusting. A root you install can vouch for any name. The registry refuses to sign names under real top-level domains and publishes every certificate it issues, but that is a promise kept by the signer, not something your device can enforce. Install it only on devices where you want Moshpit, and remove it the same way if you change your mind.

Debian, Ubuntu

sudo cp moshpit-root-ca.crt /usr/local/share/ca-certificates/
sudo update-ca-certificates

Fedora, RHEL, Arch

sudo cp moshpit-root-ca.crt /etc/pki/ca-trust/source/anchors/
sudo update-ca-trust

On Arch the folder is /etc/ca-certificates/trust-source/anchors/; the command is the same.

Chrome and Chromium on Linux

They read their own store, not the system one:

certutil -d sql:$HOME/.pki/nssdb -A -t C,, -n "Moshpit Root CA" -i moshpit-root-ca.crt

macOS

sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain moshpit-root-ca.crt

Windows

In an administrator PowerShell or Command Prompt:

certutil -addstore -f Root moshpit-root-ca.crt

Or double-click the file, choose Install Certificate → Local Machine, then Place all certificates in the following store → Trusted Root Certification Authorities.

Firefox (any desktop)

1. Settings → Privacy & Security → Certificates → View Certificates → Authorities → Import.
2. Pick the file and tick Trust this CA to identify websites.

Check that it works

1. Search chovy.hacker on pit.world: the Moshpit card shows where the name points.
2. Open https://chovy.hacker. It should load with a padlock and no warning.
3. Still a warning? The resolver works but the root is not trusted yet: see Trust the Moshpit Root CA. "Site can't be reached"? The resolver is not in use: re-check your method's steps, and close and reopen the browser.

Undo

• moshcode: moshcode dns disable.
• TronBrowser: click 🤘 Pit again.
• Browsers: set secure DNS back to your previous provider or off.
• Apple: remove the Moshpit network profile in Device Management.
• Windows: DNS server assignment back to Automatic (DHCP); remove the root in certmgr.msc → Trusted Root Certification Authorities.
• Root on Linux: delete the file you copied and run the same update command; for Chrome, certutil -d sql:$HOME/.pki/nssdb -D -n "Moshpit Root CA".

Next

On the network? Claim an ending and put your own names on it, or browse what is already there in the registry.