Selfhosted chat service

Submitted ⁨⁨2⁩ ⁨months⁩ ago⁩ by ⁨VitabytesDev@feddit.nl⁩ to ⁨selfhosted@lemmy.world⁩

After the arrest of Pavel Durov, I wanted to move from Telegram to something end-to-end encrypted. I know Signal is pretty good, but I think it is better to have our messages in my own server.

I have already looked in XMPP, but it required SSL certs and I did not have the mood to configure them.

Do you know any other selfhosted messaging service for a group of 4-5 friends, or an easy way to configure an XMPP server? Or shall I use Signal after all (I don’t really care that much about being selfhosted, I just thought it would be more privacy friendly)?

source

Comments

Sort:hotnew top

JASN_DE@lemmy.world ⁨2⁩ ⁨months⁩ ago
If setting up TLS is too much work, better stay with a service. Signal is nice.

source
wildbus8979@sh.itjust.works ⁨2⁩ ⁨months⁩ ago
SSL certs is so easy with let’s encrypt, that really shouldn’t be a blocker.

If you want something easy I think you have your answer with Signal

source
- VitabytesDev@feddit.nl ⁨1⁩ ⁨month⁩ ago
  I know, but for some reason my router does not let me access my domain (with duckdns) when connected to my network. So even if I get certs for the domain, I will not be able to access it. I have set up local DNS entries (with Pi-Hole) to point to my srrver, but I don’t know if it possible to get certs for that, since it is not a real domain.
  
  source
  - qjkxbmwvz@startrek.website ⁨1⁩ ⁨month⁩ ago
    
    I have set up local DNS entries (with Pi-Hole) to point to my srrver, but I don’t know if it possible to get certs for that, since it is not a real domain.
    
    So long as your certs are for your fully qualified domain there’s no problem. I do this, as do many people — mydoman.com is fully qualified, but on my own network I override the DNS to the local address. Not a problem at all — DNS is tied to the hostname, not the IP.
    
    source
    -> View More Comments
  - nsfwpls@lemdro.id ⁨1⁩ ⁨month⁩ ago
    Are you using a *.duckdns.com domain or is that only for Dynamic DNS pointed to something like jelly.domain.com? I’m not sure if you’ll be able to get a cert in the former scenario.
    
    Your router won’t let you access it because you’re trying to connect from your internal network to your external network, so you’re just connecting in a loop and not getting routed properly. This could work if you had a firewall that would let you set up a loopback NAT, but my guess is your router won’t let you setup NAT rules like that.
    
    You won’t be able to get a certificate using a local domain from a public certificate authority (like Let’s Encrypt). You would want to define the FQDN you want to use, like jelly.domain.com, and generate the certificate for this domain. You can do this manually with certbot and import the certificate to jellyfin, or put jellyfin behind a reverse proxy like Caddy or Nginx and let it handle automatic renewal for you.
    
    The local DNS entries would then redirect internal reauests for jelly.domain.com to your local server, which presents the same certificate for jelly.domain.com regardless of whether you’re accessing it via the private or public IP.
    
    The bonus of using something like Caddy is being able to open a single port on your router for every service. I have multiple services all accessed via the same port, and Caddy just reads the requested subdomain (jelly.domain.com, nextcloud.domain.com, etc) to route the traffic to the corresponding local server. This lets it handle every cert for all services with no manual steps needed for any of them after the initial setup, and reduces your attack surface by only having one port open.
    
    source
  - node815@lemmy.world ⁨1⁩ ⁨month⁩ ago
    Why not use a different DDNS service? There are plenty out there. :) I think this may solve your issue. I’ve been using freemyip.com’'s for a while and have had no problem in the past issusing LetsEncrypt SSL’s. At the moment, I’m on Cloudflare tunnels so it’s automatic with them, which I know is a huge trust issue for a lot of people, but I don’t mind it for my stuff. But I do like to have my DDNS as a backup service from time to time.
    
    source
  - VitabytesDev@feddit.nl ⁨1⁩ ⁨month⁩ ago
    I managed to fix this problem by pointing my domain name to my private IP address (with pihole’s local DNS entries), so I could access it. Then, I just got certs for the domain and applied them with nginx.
    
    source
hendrik@palaver.p3x.de ⁨2⁩ ⁨months⁩ ago
Most people use either Matrix or XMPP. Both work.

There is a nice overview if chat priotocols here: https://www.messenger-matrix.de/

I mostly use matrix as of today. I think it's alright. It's a bit difficult to explain encryption and device verification to other people... I think that could be designed better. But apart from that it works very well. So does XMPP which I've used before that. Have a look at the messenger matrix and all the options before deciding on an ecosystem.

source
LaSirena@lemmy.world ⁨1⁩ ⁨month⁩ ago
Signal is more likely to have more mass appeal. Matrix can bridge just about anything but is (IMHO) a pain to setup the first time. XMPP is reliable and available just about anywhere. I use the first two.

Ask your friends though.

source
Dirk@lemmy.ml ⁨1⁩ ⁨month⁩ ago
Use XMPP. Thanks to Let’s Encrypt being implemented in basically every reverse proxy, setting it up is a matter of seconds.

source
0x0@programming.dev ⁨1⁩ ⁨month⁩ ago

something end-to-end encrypted.

required SSL certs and I did not have the mood to configure them.

…right…

Did you look into snikket? It’s XMPP-in-a-box.

source
meonkeys@lemmy.world ⁨1⁩ ⁨month⁩ ago
TL;DR - use Signal.

Re: self-hosting – go for it! The DIY route is an excellent learning experience, so this is the way to go if you want your own privacy-friendly chat service. There’s quite a lot to achieving “privacy” and “security” though (heck, even defining these is challenging)… have you self-hosted before? How important are service quality / speed / reliability, backups, mobile + desktop? Will the folks you want to chat with use/like it too?

Re: Signal – definitely check out this app as well. They (the Signal Foundation) take privacy very seriously. Messages are only stored on devices running Signal, and they are ephemeral by default. Actually, that’s a good thing to consider: How important are durable / offline archives of your chats, useful with other tools (like grep?). Signal makes offline archiving difficult by design (for the sake of security/privacy).

Note that Signal is technically self-hostable, but I gather this is very difficult.

I self-host Nextcloud and I use Talk. I don’t love it, but I do find it useful for some things. Flipping on Nextcloud is pretty easy, but it is challenging to make it secure, reliable, fast, etc. And you still have to convince others to use it.

source
lascapi@jlai.lu ⁨1⁩ ⁨month⁩ ago
What about p2p messengers?

jami.net

briarproject.org

tox.chat
source
- BriarTalker@lemmy.ml ⁨1⁩ ⁨month⁩ ago
  IMO, Briar is the best option. I recently started a project to connect users in the Briar private groups and forums. We just need to get enough users active to get the network effect working for us and not against us.
  
  source
poVoq@slrpnk.net ⁨2⁩ ⁨months⁩ ago
snikket.org is the easy to configure XMPP server, but it still needs SSL certificates. But that’s fairly easy to do with Snikket AFAIK.

Or you could simply ask the Snikket developers to host a server for you for a small fee. If you are US or Canada based jmp.chat is also a great service, and it includes a free Snikket server as an add-on.

source
min@lemmy.sdf.org ⁨1⁩ ⁨month⁩ ago
I’m considering Zulip

zulip.readthedocs.io/en/latest/…/install.html

source
jdeath@lemm.ee ⁨1⁩ ⁨month⁩ ago
i was trying to find a link to Apache’s chat server that we used to power cruise ship chat applications w/out internet. i didn’t find it but this list i found has some neat projects listed, so i thought i would share that at least: medevel.com/26-os-chat-servers/ (no affiliation)

source
JetpackJackson@feddit.org ⁨1⁩ ⁨month⁩ ago
I hear XMPP through Snikket is pretty easy. I just used prosody though

source
tal@lemmy.today ⁨2⁩ ⁨months⁩ ago

I have already looked in XMPP, but it required SSL certs and I did not have the mood to configure them.

There are definitely XMPP clients that do end-to-end encryption that do not rely on TLS for key exchange, though.

en.wikipedia.org/wiki/Off_the_record_messaging

Off-the-record Messaging (OTR) is a cryptographic protocol that provides encryption for instant messaging conversations. OTR uses a combination of AES symmetric-key algorithm with 128 bits key length, the Diffie–Hellman key exchange with 1536 bits group size, and the SHA-1 hash function. In addition to authentication and encryption, OTR provides forward secrecy and malleable encryption.

The primary motivation behind the protocol was providing deniable authentication for the conversation participants while keeping conversations confidential, like a private conversation in real life, or off the record in journalism sourcing. This is in contrast with cryptography tools that produce output which can be later used as a verifiable record of the communication event and the identities of the participants. The initial introductory paper was named “Off-the-Record Communication, or, Why Not To Use PGP”.[1]

source
- czan@aussie.zone ⁨1⁩ ⁨month⁩ ago
  These days I think OMEMO is a better choice than OTR, if yaur client supports it.
  
  source
  - tal@lemmy.today ⁨1⁩ ⁨month⁩ ago
    Neat!
    
    source

Decronym@lemmy.decronym.xyz ⁨2⁩ ⁨months⁩ ago

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters	More Letters
SSL	Secure Sockets Layer, for transparent encryption
TLS	Transport Layer Security, supersedes SSL
XMPP	Extensible Messaging and Presence Protocol (‘Jabber’) for open instant messaging

[Thread #980 for this sub, first seen 19th Sep 2024, 20:25] [FAQ] [Full list] [Contact] [Source code]

source

callcc@lemmy.world ⁨2⁩ ⁨months⁩ ago
Rocket.chat could be an option

source
- transientpunk@sh.itjust.works ⁨1⁩ ⁨month⁩ ago
  I used this for a while. Notifications were lackluster on Samsung phones.
  
  source
  - callcc@lemmy.world ⁨1⁩ ⁨month⁩ ago
    What should notifications be like instead?
    
    source
    -> View More Comments