I’ve been using Signal for many years now, and it fulfils most of my messaging needs. But last year’s AWS outage, which took it offline for almost a day, showed one of its many flaws: Signal is highly centralised and reliant on big tech infrastructure.
I was therefore wondering if I shouldn’t start self-hosting my own messaging infrastructure - maybe not for my day-to-day needs, but as an emergency fallback for my closest friends and family, should Signal fail again or become unavailable or compromised (looking at you, EU Chat Control!).
My first thought was to self-host my own Matrix/Synapse server, which ticks a lot of boxes for me: end-to-end encryption, media sharing (pics, audio, videos, all that good stuff), high availability of mobile clients with modern UIs, potentially even audio/video calls. The latter is still giving me a headache since apparently, I need a TURN server to get this working properly, and I’m somewhat reluctant to open so many ports just for it to work…
What’s your perspective on self-hosting messengers: which ones do you prefer? What is your primary motivation to do it? And how have you set it up?
I was looking at nextcloud talk, bit I’m not sure how it compares. I’m also looking for backup plans for signal.
I have also tried to set that up. However:
- it’s not e2ee. Encryption is “experimental” for now, and didn’t work for me.
- it also requires a TURN server for cross-network calls and had some very weird issues on my degoogled devices (i.e. no notifications for messages or incoming calls).
That’s why I ditched it for now.
Good to know! I intended to sst it up on my Yunohost server such that it’s all locally stored. I would be using it for close family messages only, but if message are not encrypted during transit it’s bad.
Strangely, on complain I received about signal was that they found it hard to save the pictures and videos shared on it (to preserve like old photo albums would). With nextcloud talk, I would expect all the shared files to be available on the cloud drive.
but if message are not encrypted during transit it’s bad.
I did not say that. ;) If you’ve secured your connection via SSL (which Nextcloud AIO forces you to do anyway), messages are encrypted in transit.
I said they’re not end-to-end encrypted, i.e. they’re stored on the server without encryption. To be fair, in theory, this is less of an issue if you’re the one hosting the service.
Strangely, on complain I received about signal was that they found it hard to save the pictures and videos shared on it
That is somewhat true. Messengers like Telegram (yuck!) and (correct me if I’m wrong!) even Meta’s Whatsapp (doubleyuck!) do or at least can store all media unencrypted on the device in a folder. Signal does not do this. Every single pic/vid/whatever needs to explicitly be stored in device memory in encrypted form (there’s even a nag screen every time you do this). Also Signal does no appear to have an option so it will store media in encrypted format to the device storage. (Just looked, didn’t find anything of that kind.)
With nextcloud talk, I would expect all the shared files to be available on the cloud drive.
That might be correct. When you install it, Talk stubbornly creates a “Talk” folder in your NC files, which is likely to hold all media shared via Talk.
XMPP hosted via Raspberry Pi.
The setup is:
- Prosody provides the XMPP server.
- Converse.js provides web client / PWA.
- Conversations for Android clients
- Coturn provides TURN services for calls and NAT traversal.
- Tailscale provides remote access without exposing the XMPP server directly to the public internet.
(nb: also configured Message Archive Management (MAM) for chat history, private multi-user chat rooms (MUC), HTTP File Upload for media, and Jingle signalling for audio/video calls).
The server is designed to be accessible over our LAN. When away from home, family members connect through Tailscale (I really should just use Android actions and geofencing to auto launch Tailscale, but on my kids devices, I just leave Tailscale enabled. I don’t think it hits the battery too hard). Tailscale can only connect to XMPP and we keep our XMPP to family only, with me manually adding devices to Tailscale as I need to.
As for why? Because I get joy from hosting my own shit, having control over it, having it work when other stuff falls over. My stuff falls over too, but I know WHY and HOW to fix it, and that’s how I prefer it. I want to get to the point that if the internet dies tomorrow, I shrug my shoulder and barely notice.
My goal is to replace all cloud based services we use and I’m about 85% of the way there. I have a much larger goal too…but that’s a story for a different time.
PS: I’m mildly irritated about Tailscale use, so I’m looking at getting off that teat as well eventually for a self hosted solution. There are some issues with Headscale and I don’t want to punch holes in firewall if I can avoid it. Still thinking on it.
PPS: Meshtastic, Reticulum etc all seem super cool…but until there’s interoperability simple enough for normies…good luck getting buy in. I struggle to convince the fam to use XMPP (weird issues with android clients, Tailscale drop outs etc).
There’s no federated messenger yet that withstands domain theft or abandonment while providing a good group experience, so I’m still waiting for someone to make one.
If you choose to go with Matrix, I would strongly recommend you to give the Continuwuity server a try. It is quite simple to install, much less resource-intensive than the commonly-used Synapse, and has an active community behind it.
apparently, I need a TURN server to get this working properly
Do note, Matrix recently has a new calling stack called MatrixRTC, and for that you would be setting up LiveKit in place of a TURN server. That also opens many ports by default, but I think there is a “UDP mux” mode that listens all on one port. I’ll be looking into it soon.
The other alternative is XMPP, which is a bit more complex to set up (more ports and subdomains, non-HTTP protocol etc) but is generally more lightweight and fast. ejabberd is my choice, but people tend to like Prosody and Snikket as well. While they use the traditional TURN servers for calls, their clients could use a lot of improvements though…
So yeah, my Continuwuity and the XMPP server sits on a small homelab machine, and with some extra tuning and grit, they work well. LiveKit and TURN sits on a VPS for better network performance. To be honest, I do all of this mainly because I wanna talk to cool people on the internet, so the service has to be federatable.
Plus one for continuwuity. Setting up that and livekit for RTC connection was pretty simple following the instructions. Its been simple to maintain and the clients have improved recently. We have messaging plus voice and video calls working great and I have no issues with notifications that used to plague the matrix clients in the past. I self host a Cinny instance as a web hosted client as well.
This thread is making me wish it was easier to host Signal and that you didn’t have to compile your own clients.
Self-hosted messaging was solved decades ago, it’s called XMPP or Jabber depending on who do you ask. There are a number of services for it, such as Prosody or ejabberd, and there are both client apps (eg.: Conversations for Android, Gajim or Dino for PC) and a number of webclients (such as converse.js which can actually be shipped via a ejabberd install).
That said you could just set up an alternative Signal client that allows for custom servers, since the centralization of Signal only really exists at the level of the client only connecting to Signal’s servers… Signal’s people have pointed this out themselves, when offering bridge setups so that people could connect from Iran or other countries where those countries blocked Signal’s endpoints.
I unfortunately wouldn’t call it solved. I host XMPP and Matrix, (and a STUN/TURN server, and a Livekit server for the modern matrix calls…), and nothing is perfect.
Prosody is really great because it’s so no-nonsense. It doesn’t hog resources or choke up like matrix servers do if you suggest to them that maybe they could deliver this text message? :3 Oh, no, it’s “hold for 2 weeks despite the recipient being online” again? Ok…
But XMPP is still incredibly hard to recommend for me, because
- no way to read old chats on new devices, which honestly is close to a deal-breaker for many people, myself inclided. And
- apart from maybe monocles on android, the clients just suck ass. They’re bad. Their UI/UX is stuck 20 years ago, and that does matter.
Hence why I still mostly use Matrix… Even though it’s such a stupid, stupid protocol.
@smiletolerantly @lambalicious “no way to read old chats on new devices,”
If you’re talking about unencrypted messages, then prosody’s mod_mam (https://prosody.im/doc/modules/mod/_mam) will store messages for a configurable amount of time and allow all devices to sync older messages.
If you’re talking about encrypted messages, you have two choices. OMEMO is the standard means for encrypting XMPP messages, & only works in forward mode; you can’t decrypt old messages. OpenPGP, however, decrypts old msgs.
Yes, encrypted (otherwise what’s the point? 😄). I’ll admit I haven’t tried the PGP version yet. How’s client support? For OMEMO it’s pretty lackluster, from what I’ve heard not much different for PGP?
In any case, perfect forward secrecy is definitely a good thing / strength, but I’d like a way to re-encrypt messages from an old device, just as an example, during the setup process; or a standardized way to export all history; or just something beyond “either use worse or no encryption, or loose access to your history eventually”.
@smiletolerantly @lambalicious tbh though, I’ve never used openpgp with xmpp because I prefer OMEMO’s forward secrecy. Transferring/introducing a new device, I usually back up chats on the old/current device and import it into the new device’s client.
+1 for prosody. But you’ll still probably need a turnserver for calls, won’t you?
I’m unsure what’s the progress status over there so I’ll say “yes?”.
Which reminds me, I think there is a binding somewhere that lets XMPP send SMS messages, but dunno how if any is that related to phone call compatible audio.
I have literally never heard anyone mention xmpp outside of Lemmy. Anyways it is a dead technology due to how fragmented it is along with its reliance on XML
What’s so wrong with XML? All web browsers use it (HTML is literally slightly-freeform XML), Libreoffice also does (XML is part of the Open Document format spec), Freedesktop… eeeh, let’s not mention them, and so far we are doing golden.
XML is really inefficient and sometimes vulnerable to denial of service attacks due to it being hard to parse.
Oh yeah, very dead… omg so dead… like, no one uses it… at all…
if the /s isn’t obvious
Have you looked at all into Meshtastic? Depending on where you are, it may work quite well for local communications
I’ve come across it, and I love the concept of making communication even more robust by making it independent even of the infrastructure of the internet. That said, I assumed that it would come with a lot more friction than the userbase I have in mind would tolerate. For now, my plan is to first seek an equally accessible, yet more decentralised alternative to Signal, and reserve digging into mesh networks for later.
Matrix/Synapse is pretty easy to set up… the encryption is a bit on the kludgy side, but it definitely works… I run it over a cloudflare tunnel (inbound) and perm-VPN tunnel (outbound)
I can give you a sample docker-compose file I use if you’d like. ;-)
Thank you so much for your offer! I’ve actually set it up last night and it’s running fine so far. It’s just that it won’t relay any calls if either of the devices is not on my network. Tunneling back into the network via VPN might be an option, but make it more cumbersome to use for some of the less techy folks around me.
What’s your primary reason to self-host Synapse? And who do you use it with?
Getting off corporate messaging…I use it for family and friends, people I know personally… But it is fully federated so I can get to some of the groups and such… matrix community servers and the like. :)
Mostly I started investigating it when Discord started talking about age-verification… Figured it was a good idea to have an exit strategy…
I prefer XMPP, its very simple unlike Matrix and I set up a prosody server.
https://www.whitenoise.chat/ looks nice. Have not used it much myself, but ticks my boxes.
Simplex chat looks interesting although I don’t use it
I would recommend that you use what the people around you use
I would recommend that you use what the people around you use
That’s not what I have in mind. I’m playing trailblazer here: at least for the people closest to me, I want an alternative means of communication that will be ready in a minor shit-hits-the-fan scenario (i.e. one where Signal for instance goes tits up, like it already has once).
I also self-host a messaging service. My infrastructure is a homing pigeon coop.
/uj I like your question and couldn’t contribute technically, so hope you get a laugh
Matrix is the most popular one these days, and it’s worth considering just for that reason, but it is also extremely buggy and slow. I can’t tell you how many timed I’ve been booted and locked out of my own account, or someone sends me a message, only to receive “message cannot be decrypted” error.
If you’re starting something new that you’re bringing other people to, I’d very much recommend DeltaChat/ArcaneChat (chatmail). It’s been far more reliable and easier to use.
I’ve never used XMPP because all of the clients are extremely dated.
Conversations for Android and gajim are fantastic XMPP clients and very modern.
I don’t agree at all.
What is it missing? When was the last time you tried them?
Conversations was updated was 14 days ago
Getting updates doesn’t make it modern.
I’ve never used XMPP because all of the clients are extremely dated.
This is what I was referring to.
Did you mean something else?
Dated as in features and appearance
1 - great username, 2 - I no longer have these issues with my setup, been running for 5 years now (but an update seems to have broken Element Call
Well, I’m happy for you, but I am currently locked out of my account. All of my devices were booted for some reason and now it’s not accepting my encryption key that I’ve been using for years to get back in, and I can’t use another device to verify, because they were all booted simultaneously.
There is an admin override available. Depending on your version (i use continuwuity) there’s a toml config or maybe .env, and an admin_pass. @admin:domain and this key will hopefully show something
Okay. Thank you but I don’t know what to do with this information.
Looking at self-hosting I would rather go with chatmail, part of the deltachat ecosystem. Contrary to others the account doesn’t live on the server but on devices: a server going down merely affects connectivity, not the whole identity. Moreover servers are made to be redundant such that messages can transit through pretty much any of them. So when one goes down the app switches to another one and the downtime is invisible
