mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
* docs(b2-7): trust model — who can read what (BPR-050/051, C-09 contract)
One document states the operator trust model in plain language and traces
every claim to a code line or test: server-readable text and files and why,
E2EE voice/video/screen with the key-holder and TOFU rules, transport per TLS
mode with desktop pinning and the browser rule, the C-09 preview destination
contract B7 implements, at-rest storage, operator can/cannot, multi-device
sessions, and what beta does not claim. Linked from security.md,
deployment.md, quick-start.md and docs/README.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* test(b2-7): absence proofs — no federation/directory routes, outbound host table
TestAbsenceContract_NoFederationDirectoryOrListingRoutes builds the production
router with uploads, voice and GIF on, walks the whole mounted tree with
chi.Walk and fails on any route matching federat|directory|discover|listing.
A floor on the route count and a check that the admin subtree was traversed
keep it from passing vacuously. trust-model.md gains "What OwnCord does not
have" (BPR-040/082/083) and the outbound-host table B6's network capture
checks against.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* docs(b2-7): plugin boundary — off twice, compiled out of releases, no API promise
docs/architecture/plugins.md records the experimental WASM boundary (BPR-080/
081, BG-17): disabled by build tag and by config, absent from release.yml and
Dockerfile builds, the HP-2 configuration audit (fresh, upgraded, Docker,
standalone), the beta release-notes wording, what exists today with its limits
and tests, the post-beta plugin candidates that stay in core during beta, and
the core concerns that never move. Linked from architecture/README.md,
architecture/server.md and docs/README.md.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* docs(b2-7): L-08 re-tagged to B10 with the reason; B2-7 evidence block
L-08's remaining gate ("deterministic source build passes") cannot pass in
principle — TinyGo embeds host paths and has no -trimpath — and a compile-only
drift check would need a second Go SDK, TinyGo and Binaryen on every PR for a
subsystem release builds compile out. Re-tagged to B10, which runs the compile
once against the release candidate or closes on the provenance record; the
"no API promise" half is closed by docs/architecture/plugins.md. The plan's
B2-7 evidence block records the four pre-squash SHAs, the absence test's RED
output, the release-build finding, the decision, and the BPR-051 reader
placeholder. CHANGELOG gains a Documentation block.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex review — TOFU windows disclosed, legacy TOTP, absence test at three boundaries
Two P1 and three P2 from the Codex review of 56f23a36, all verified against
the code. trust-model.md now states the desktop's first-connection TLS TOFU
window and the out-of-band fingerprint check; scopes identity-key pinning to
changes after the first pin, not first contact; discloses that databases from
before TOTP encryption may still hold plaintext secrets and how re-enrolment
fixes that. The absence contract gains two sibling tests — WebSocket wire
types from protocol/schema.json and every koanf key of config.Config (one
allowlisted on-disk path whose presence the test asserts) — and the document
states what the three tests bound. plugins.md corrected: unknown config keys
are warned about and ignored, not rejected. Evidence block records PR #1443
and the review outcome.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex re-review — desktop first-use window in every TLS mode; tls off is plaintext
The desktop pins the fingerprint it sees on first connection in every
tls.mode (CaptureVerifier, no web-PKI validation on the server connection),
so a public-CA certificate closes the first-use window only for a browser;
the short answer and the pinning list now say so. tls.mode off served
directly is plaintext HTTP with nothing enforcing a proxy; the transport
table row states it. Evidence block records the round-2 outcome.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex round 3 — E2EE does not survive a hostile operator on first contact; memory cap is server-wide
Identity keys are trusted on first use, so a modified server can deliver an
unpinned peer's first announce with keys the operator holds and the key
holder wraps the room key to it. trust-model.md now scopes E2EE to an
operator who reads, and to a modified server only for peers pinned and
compared out of band beforehand, in every place the stronger claim stood.
plugins.md: the wazero runtime is sized from plugins.max_memory_mb alone;
a manifest's memory value is validated but not applied. Evidence block
records the round.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex round 4 — transport intro excludes tls off; ipAllowed is not the full C-09 deny-set
The transport section opened with "everything is TLS"; it now excludes
tls.mode off. The C-09 contract cited the server's ipAllowed as the complete
address deny-set; it rejects loopback, private, link-local, unspecified,
multicast and CGN only, so the clause now lists the documentation and
benchmarking ranges the native broker must add and records that widening
ipAllowed is a separate server change.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex round 5 — backups exclude uploads; release-time appimagetool fetch listed
The built-in backup is VACUUM INTO of the SQLite file only; the trust model
and deployment.md now say uploaded files are not in it and upload.storage_dir
needs its own backup. The outbound-host section scopes "no script fetches an
external host" to scripts the server runs and lists the release workflow's
build-time appimagetool download.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
* fix(b2-7): Codex round 6 — one pin per account, LiveKit media in the host table, quick-start wording
Identity pins are keyed by host and user id, so a peer's second device
overwrites the pin and the first device then mismatches; the document no
longer claims per-device pinning. The outbound-host table gains the
supervised LiveKit subprocess's WebRTC media and scopes the capture contract
to traffic the server initiates. The quick-start cross-link no longer says
voice and video are unreadable by the operator.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Rg9QQWVN3E5UUgBD2dydtu
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
124 lines
3.8 KiB
Markdown
124 lines
3.8 KiB
Markdown
# Quick Start Guide
|
|
|
|
Get OwnCord running with the fewest possible steps.
|
|
|
|
## Choose Your Setup Path
|
|
|
|
| Goal | Best path |
|
|
| ------------------------------------ | ----------------- |
|
|
| Fastest local/LAN setup | Prebuilt binaries |
|
|
| Linux server with easiest operations | Docker |
|
|
| Custom dev build | Build from source |
|
|
|
|
## Platform Support (Current Releases)
|
|
|
|
| Component | Windows x64 | Linux x64 | Linux ARM64 |
|
|
| -------------- | ----------- | --------- | ----------------- |
|
|
| Server binary | Yes | Yes | Not published yet |
|
|
| Desktop client | Yes | Yes | Yes |
|
|
|
|
## Prerequisites
|
|
|
|
- Go 1.26+ (only if building server from source)
|
|
- Node.js 24+ and Rust (only if building client from source)
|
|
- Docker + Compose v2 (Docker path only)
|
|
- LiveKit (optional, required for voice/video)
|
|
|
|
## Option A: Prebuilt binaries (recommended)
|
|
|
|
1. Download from [GitHub Releases](https://github.com/J3vb/OwnCord/releases).
|
|
2. Start the server:
|
|
- Windows: `chatserver.exe`
|
|
- Linux: `./chatserver`
|
|
3. Open `https://localhost:8443/admin`.
|
|
4. Complete the setup wizard: it creates the Owner account and configures the
|
|
basics (server name, port, security, uploads, voice). Your choices are
|
|
written to `config.yaml` automatically — no manual editing needed.
|
|
5. Create invite codes and share them.
|
|
|
|
## Option B: Docker (Linux server)
|
|
|
|
```bash
|
|
cd Server
|
|
cp .env.example .env
|
|
cp livekit.yaml.example livekit.yaml
|
|
# Edit both files before start
|
|
docker compose up -d
|
|
```
|
|
|
|
Then open `https://localhost:8443/admin` and complete the setup wizard.
|
|
|
|
Full Docker details: [Deployment Guide](deployment.md#docker-linux).
|
|
|
|
## Option C: Build from source
|
|
|
|
```bash
|
|
# Server (Windows)
|
|
cd Server
|
|
go build -o chatserver.exe -ldflags "-s -w -X main.version=1.2.0-alpha.4" .
|
|
|
|
# Server (Linux)
|
|
cd Server
|
|
CGO_ENABLED=0 go build -o chatserver -ldflags "-s -w -X main.version=1.2.0-alpha.4" .
|
|
|
|
# Client
|
|
cd Client
|
|
npm install
|
|
npm run tauri build
|
|
```
|
|
|
|
## What Happens on First Server Start
|
|
|
|
- `config.yaml` is created with defaults.
|
|
- `data/` is created for DB, certs, uploads, and backups.
|
|
- A self-signed TLS certificate is generated.
|
|
- SQLite schema and migrations are applied.
|
|
|
|
## Client Connection Notes
|
|
|
|
- The default server address is `https://<server-ip>:8443`.
|
|
- The desktop client uses TOFU certificate pinning:
|
|
- First connection prompts for trust.
|
|
- Future connections require the same cert fingerprint.
|
|
- Who can read what on a server you run or join — text is readable by the
|
|
operator; voice and video are end-to-end encrypted, with the limits that
|
|
document states — is in [trust-model.md](trust-model.md).
|
|
- Linux/Wayland: the client automatically sets `WEBKIT_DISABLE_DMABUF_RENDERER=1`
|
|
on Wayland sessions to work around WebKitGTK rendering crashes. Export the
|
|
variable yourself (any value) before launching to override this.
|
|
|
|
## If Remote Users Cannot Connect
|
|
|
|
1. Use [Tailscale](tailscale.md) for the simplest remote setup.
|
|
2. Or configure [Port Forwarding](port-forwarding.md).
|
|
|
|
## Optional: enable the GIF picker
|
|
|
|
GIFs are **off by default** and each server supplies its own key — OwnCord does
|
|
not ship one, so nothing is shared between servers.
|
|
|
|
1. Request a key at [partner.klipy.com](https://partner.klipy.com).
|
|
2. Set it on the server, then restart:
|
|
|
|
```bash
|
|
# Preferred — keeps the credential out of config.yaml
|
|
OWNCORD_GIF_API_KEY=your_key_here
|
|
```
|
|
|
|
Or in `config.yaml`:
|
|
|
|
```yaml
|
|
gif:
|
|
api_key: "your_key_here"
|
|
```
|
|
|
|
The key stays server-side; clients only ever call `/api/v1/gif/*` on their own
|
|
server. Until one is set, the client's GIF button is disabled with
|
|
"GIFs are not enabled on this server" — nothing else is affected.
|
|
|
|
## Next Steps
|
|
|
|
- [Server Configuration](server-configuration.md)
|
|
- [Deployment Guide](deployment.md)
|
|
- [LiveKit Setup](livekit-setup.md)
|