Run your own server
Run the server file. The setup wizard asks for a name and password. Open one port. There is nothing else to install. There is no cloud account.
- What you need
- A Linux machine or a Windows 10 or 11 PC with a public address. The server is a single file with its own small database built in.
- What has to be open
- Open port 8444 for voice and video. Web traffic uses the forwarding or tunnel you already have.
- What you hand out
- The server address and the join password. Those two things are the whole invitation.
Getting a server running, in six steps
-
Download the server file
The server is one file. Windows and Linux x86_64 are both published; ARM64 is not yet. On Linux the download is a tarball with a one-command install; on Windows it is an installer. The download page has the file, its size and its checksum.
-
Run the setup wizard once
The wizard asks for a server name, a join password and an admin password. It writes veiled.toml beside the server, and makes the server's signing key into identity.json.
-
Choose a name and a join password
The name is what invited people see. The join password is what they type to get in, and it is never sent anywhere, so even a server that is taken over cannot learn it.
-
Start the server
One process serves the web page, the chat connection and voice, on port 8443. If no security certificate is set up yet, it makes one of its own and prints a short fingerprint. A server can be running inside a minute, and a real certificate can be added later.
-
Open one port
Voice and video use port 8444, one port and not a range of them. The rest travels through whatever forwarding or tunnel is already in place, and the wizard prints the exact lines to add to a firewall or a router.
-
Share the address and the password
Those two things are the whole invitation. The next fold-out on this page is what the invited person does with them.
Joining a server someone else runs
Nothing to install.
-
Get the address and the join password
The host sends both. The address looks like a website address, for example chat.example.org.
-
Open the address in a browser
The web client is served by that server, so there is no download and no install. The address can also be pasted into the box on the front page.
-
Type the join password
The browser asks for the password the host set. It is checked without ever being sent, so it stays between the member and the host.
-
Choose a display name
The device makes its own keys at that point, and the name is the label that goes with them. There is no signup, no email and no password reset to go through.
-
Allow the microphone when the browser asks
That is what lets voice work in the browser. Typing and reading need no permission at all.
A desktop app is planned for smoother voice. It is not published yet, and the browser covers text, voice and screen share in the meantime. When it is published it will be listed on the download page.
What that costs to run
Nothing in the path but one machine.
- Hardware
- Any machine that can stay switched on and reachable. Voice is passed on without being decoded, so a call of half a dozen people costs well under one processor core. A small rented server or an always-on desktop is enough.
- Bandwidth
- Each block of voice is sent once to every other person in the room, so a call of five people means the host sends four copies. Voice blocks of ten milliseconds at 32 kbit/s come to about 40 kB/s per stream.
- A domain name
- Optional, and worth it. A real certificate needs a name to be issued for. An address with only numbers means a browser warning every time, which does not stop a browser from connecting once the fingerprint has been accepted.
- Looking after it
- One file to replace, one database to back up, and nothing to re-encrypt. An upgrade is three steps: stop the server, drop in the new file, start it again.
The hosting guide goes further: certificates, running the server as a service on Linux, backups, upgrades, and the handful of failures worth knowing about before they happen.