🤖 Self-hosting Eleven

Run your own Eleven server: end-to-end-encrypted group chat where your box never sees a message — the server stores only ciphertext, and every key stays on your members' devices. One static binary, one directory of state, automatic TLS, automatic updates.

> This page is published as the README of > elevenmessenger/releases > (the public downloads repo). Its source of truth is docs/self-hosting.md > in the main repo.

What you need

• A Linux box: Ubuntu or Debian with systemd (what we test on), x86_64 or arm64, 1 GB RAM is plenty to start. A €4/month VPS works.
• Root on it, with inbound ports 80 and 443 open.
• A domain (or subdomain) you can point at the box.

Install

curl -fsSL https://github.com/elevenmessenger/releases/releases/download/server/install.sh | sudo bash

That downloads the latest stable release for your architecture, verifies its published sha256, installs it at /opt/lchat/lchat, and bootstraps the box: a locked-down service user, systemd units, the TLS router on 80/443, and the hourly auto-update timer. (Prefer not to pipe to shell? Download install.sh from the same URL, read it — it's short — then run it.)

Create your first chat

Point a DNS A record at the box (chat.example.com → your box IP), then:

lchat add-instance chat.example.com

It prints a one-click setup link. Open it: you pick a name, your browser generates your keys (they never leave it), and Eleven walks you through naming the space and inviting people. The Let's Encrypt certificate issues automatically on the first request — no certbot, no reverse proxy.

Each add-instance creates a fully isolated chat: its own database, admin token, and subdomain. Run one for the family and another for the club; they share nothing.

What you get out of the box

• End-to-end encryption: messages, names, photos, and files are encrypted on devices; the server relays and stores ciphertext. If your box is compromised, the attacker gets nothing readable.
• Web app + notifications: members use it from any browser; web push notifications work with zero configuration.
• Automatic updates: the box checks our signed release feed hourly and applies stable-channel updates with a health check and automatic rollback. Each chat's admin can change channel (stable/beta/edge) or turn auto-updates off in the admin panel; lchat update status shows the fleet.
• Bots, optionally with AI: lchat bot provision + lchat bot run (same binary, no other runtime) adds the built-in helpers — Eleven welcomes new members and answers slash commands. Set ANTHROPIC_API_KEY and they get a brain; without it they're deterministic helpers. See docs/bots.md.

Honest limitations

• Native app push: members can use the Eleven iOS/Mac apps against your server, but native push notifications route through Apple via our central relay, which needs a per-server token we mint. Web push is unaffected. If you want native push for your server, ask us for a relay token (open an issue on this repo) — self-serve is planned.
• Passkey backup routes through us by default: the optional "save a passkey" account backup enrolls against our home server (home.elevenmessenger.com). What's stored there is passkey-encrypted — we can't read it — but if you'd rather keep even that ciphertext on your own hardware, run the home service yourself and set LCHAT_HOME_ORIGIN in the instance's /data/<host>.env.
• The trust root for updates is ours: auto-updates install binaries we sign. That's the point of the channels — but if you fork, build your own binary with your own key and feed URL (LCHAT_UPDATE_MANIFEST_URL).

Operating it

• Everything lives in /data — databases, TLS certs, tokens, env files. Back that directory up and you can rebuild the box from scratch. (For continuous backups, Litestream replicating /data/*.db to object storage works well; the installer doesn't set this up for you.)
• Updates: automatic. lchat update status shows every chat's channel and version; lchat update run --dry-run previews a pass; a bad release rolls itself back. Re-running the install one-liner also updates immediately and refreshes the systemd units.
• Admin access: lchat admin-link chat.example.com re-prints a chat's admin URL (it's also in /data/<host>.env).
• Remove a chat: lchat remove chat.example.com --stop stops it and unroutes it; its database stays in /data until you delete it yourself — removal never destroys data.
• Hardening: the units are already sandboxed; for the box itself, a firewall (22/80/443), key-only SSH, and unattended OS upgrades are the standard trio. Going further is optional: our own fleet closes public port 22 entirely — SSH rides a WireGuard tunnel (invisible to scanners), root login is disabled after first setup, and day-to-day admin runs through named accounts with a committed sudo allowlist. The full recipe, including the break-glass path via your provider's rescue console, is in docs/instance-router.md § Hardening in the main repo.

Scaling up (optional)

The same binary contains the multi-tenant machinery we run 11ch.at with — a self-serve provisioner, wildcard DNS-01 certificates (LCHAT_WILDCARD_DOMAINS + a DNSimple token), and a central home server. None of it is needed for a personal box; the design docs live in the main repo under docs/.