| 1 | # 🤖 Self-hosting Eleven |
| 2 | |
| 3 | Run your own Eleven server: end-to-end-encrypted group chat where **your box |
| 4 | never sees a message** — the server stores only ciphertext, and every key stays |
| 5 | on your members' devices. One static binary, one directory of state, automatic |
| 6 | TLS, automatic updates. |
| 7 | |
| 8 | > This page is published as the README of |
| 9 | > [`elevenmessenger/releases`](https://github.com/elevenmessenger/releases) |
| 10 | > (the public downloads repo). Its source of truth is `docs/self-hosting.md` |
| 11 | > in the main repo. |
| 12 | |
| 13 | ## What you need |
| 14 | |
| 15 | - A Linux box: **Ubuntu or Debian** with systemd (what we test on), `x86_64` |
| 16 | or `arm64`, 1 GB RAM is plenty to start. A €4/month VPS works. |
| 17 | - **Root** on it, with inbound ports **80 and 443** open. |
| 18 | - A **domain** (or subdomain) you can point at the box. |
| 19 | |
| 20 | ## Install |
| 21 | |
| 22 | ```sh |
| 23 | curl -fsSL https://github.com/elevenmessenger/releases/releases/download/server/install.sh | sudo bash |
| 24 | ``` |
| 25 | |
| 26 | That downloads the latest **stable** release for your architecture, verifies |
| 27 | its published sha256, installs it at `/opt/lchat/lchat`, and bootstraps the |
| 28 | box: a locked-down service user, systemd units, the TLS router on 80/443, and |
| 29 | the hourly auto-update timer. (Prefer not to pipe to shell? Download |
| 30 | `install.sh` from the same URL, read it — it's short — then run it.) |
| 31 | |
| 32 | ## Create your first chat |
| 33 | |
| 34 | Point a DNS **A record** at the box (`chat.example.com → your box IP`), then: |
| 35 | |
| 36 | ```sh |
| 37 | lchat add-instance chat.example.com |
| 38 | ``` |
| 39 | |
| 40 | It prints a one-click **setup link**. Open it: you pick a name, your browser |
| 41 | generates your keys (they never leave it), and Eleven walks you through naming |
| 42 | the space and inviting people. The Let's Encrypt certificate issues |
| 43 | automatically on the first request — no certbot, no reverse proxy. |
| 44 | |
| 45 | Each `add-instance` creates a **fully isolated** chat: its own database, admin |
| 46 | token, and subdomain. Run one for the family and another for the club; they |
| 47 | share nothing. |
| 48 | |
| 49 | ## What you get out of the box |
| 50 | |
| 51 | - **End-to-end encryption**: messages, names, photos, and files are encrypted |
| 52 | on devices; the server relays and stores ciphertext. If your box is |
| 53 | compromised, the attacker gets nothing readable. |
| 54 | - **Web app + notifications**: members use it from any browser; web push |
| 55 | notifications work with zero configuration. |
| 56 | - **Automatic updates**: the box checks our signed release feed hourly and |
| 57 | applies **stable**-channel updates with a health check and automatic |
| 58 | rollback. Each chat's admin can change channel (stable/beta/edge) or turn |
| 59 | auto-updates off in the admin panel; `lchat update status` shows the fleet. |
| 60 | - **Bots, optionally with AI**: `lchat bot provision` + `lchat bot run` (same |
| 61 | binary, no other runtime) adds the built-in helpers — Eleven welcomes new |
| 62 | members and answers slash commands. Set `ANTHROPIC_API_KEY` and they get a |
| 63 | brain; without it they're deterministic helpers. See `docs/bots.md`. |
| 64 | |
| 65 | ## Honest limitations |
| 66 | |
| 67 | - **Native app push**: members can use the Eleven iOS/Mac apps against your |
| 68 | server, but native *push notifications* route through Apple via our central |
| 69 | relay, which needs a per-server token we mint. Web push is unaffected. If |
| 70 | you want native push for your server, ask us for a relay token (open an |
| 71 | issue on this repo) — self-serve is planned. |
| 72 | - **Passkey backup routes through us by default**: the optional |
| 73 | "save a passkey" account backup enrolls against our home server |
| 74 | (`home.elevenmessenger.com`). What's stored there is passkey-encrypted — |
| 75 | we can't read it — but if you'd rather keep even that ciphertext on your own |
| 76 | hardware, run the `home` service yourself and set `LCHAT_HOME_ORIGIN` in |
| 77 | the instance's `/data/<host>.env`. |
| 78 | - **The trust root for updates is ours**: auto-updates install binaries we |
| 79 | sign. That's the point of the channels — but if you fork, build your own |
| 80 | binary with your own key and feed URL (`LCHAT_UPDATE_MANIFEST_URL`). |
| 81 | |
| 82 | ## Operating it |
| 83 | |
| 84 | - **Everything lives in `/data`** — databases, TLS certs, tokens, env files. |
| 85 | Back that directory up and you can rebuild the box from scratch. (For |
| 86 | continuous backups, [Litestream](https://litestream.io) replicating |
| 87 | `/data/*.db` to object storage works well; the installer doesn't set this |
| 88 | up for you.) |
| 89 | - **Updates**: automatic. `lchat update status` shows every chat's channel and |
| 90 | version; `lchat update run --dry-run` previews a pass; a bad release rolls |
| 91 | itself back. Re-running the install one-liner also updates immediately and |
| 92 | refreshes the systemd units. |
| 93 | - **Admin access**: `lchat admin-link chat.example.com` re-prints a chat's |
| 94 | admin URL (it's also in `/data/<host>.env`). |
| 95 | - **Remove a chat**: `lchat remove chat.example.com --stop` stops it and |
| 96 | unroutes it; its database stays in `/data` until you delete it yourself — |
| 97 | removal never destroys data. |
| 98 | - **Hardening**: the units are already sandboxed; for the box itself, a |
| 99 | firewall (22/80/443), key-only SSH, and unattended OS upgrades are the |
| 100 | standard trio. Going further is optional: our own fleet closes public |
| 101 | port 22 entirely — SSH rides a WireGuard tunnel (invisible to scanners), |
| 102 | root login is disabled after first setup, and day-to-day admin runs |
| 103 | through named accounts with a committed sudo allowlist. The full recipe, |
| 104 | including the break-glass path via your provider's rescue console, is in |
| 105 | `docs/instance-router.md § Hardening` in the main repo. |
| 106 | |
| 107 | ## Scaling up (optional) |
| 108 | |
| 109 | The same binary contains the multi-tenant machinery we run |
| 110 | [11ch.at](https://11ch.at) with — a self-serve provisioner, wildcard |
| 111 | DNS-01 certificates (`LCHAT_WILDCARD_DOMAINS` + a DNSimple token), and a |
| 112 | central home server. None of it is needed for a personal box; the design |
| 113 | docs live in the main repo under `docs/`. |
| 114 | |
amadan