A chat that works
when the internet doesn't.

01Identity

On first launch the phone makes an Ed25519 keypair; the public key is you, and a 24-word phrase encodes it. Write it down — it is the only backup. Every frame is signed. Other phones pin your key the first time they see it; if it ever changes, they say so and ask you to compare safety numbers in person.

02Nearby

Google Nearby Connections over Bluetooth, BLE and Wi-Fi — a flooding mesh. Every phone forwards what it hears, dedups by id, and decrements a TTL that starts at 6. That arithmetic is where hop counts come from. Voice is IMA-ADPCM at 16 kHz.

03Beacon

A WebSocket to a relay you choose — several at once if you like; a phone on two beacons bridges them. The beacon is deliberately dumb: it fans frames out, keeps history for anchored rooms, and lists public ones. It never sees a key that could decrypt a sealed room or a DM, and it stores no DMs at all.

04Rooms

A room is one conversation: one text stream, one voice room. It has an owner, mods, an access tier, post policy, slow mode, retention. Anchor it on a beacon to outlive your phone; make it local-only and no relay will ever carry a frame for it.

05Dead drops, precisely

An ordinary message with drop and expires at the envelope level, so carriers see them without opening a sealed body. Phones store the raw signed bytes and re-offer them on every new mesh link. Never sent to a beacon. 7 days, 16 KB, 200 per phone; expired ones are refused.

06Home beacon

Mark a relay ★ home and it keeps the history of every room you're in — 20,000 messages a room, on your box. Search reaches into it; a zip export is one tap. Two homes is failover for free.

07Notifications

The app holds its own connection — the honest cost of having no push server, and the reason there's a (hideable) "connected" notification. Messages land in Android's Conversations, can be bubbled, and take an inline reply from the shade.

08Storage

Everything stays on the phone: history, media within a budget you set, keys, settings. Cloud backup is off on purpose — an app that promises sealed rooms should not be uploading room keys to Google. Export any conversation as text.

docker

cd beacon
docker compose up -d
docker compose logs -f beacon   # prints the public key on boot

State in ./data/. Port 8787.

linux + systemd

cd beacon
CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o beacon-linux-amd64 .
sudo ./deploy.sh ./beacon-linux-amd64
sudo systemctl restart beacon   # deploy.sh doesn't restart a running one

A beacon user, /opt/beacon, a hardened unit, state in /var/lib/beacon/.

tls

# Caddyfile
beacon.example.org {
    reverse_proxy localhost:8787
}

Then phones use wss://beacon.example.org/mesh. Start the beacon with -public wss://…/mesh so this page and /beacon.json advertise it.

doctor

beacon doctor -db /var/lib/beacon/beacon.db

Checks the service, config, disk, live stats, and the public path — DNS, certificate expiry, HTTP through the proxy, a real WebSocket ping through the proxy, identity match — then prints the URL and a QR. Exit 1 on any problem; put it in a cron.