A home for your community
that can’t be taken away.
Servers get banned. Features you used to have get moved behind a subscription. The rules change, and the history your community built sits on someone else’s computer.
AuraLeaf is chat, voice, video and streaming — everything you already do every day — except it lives on a server your community owns. No subscriptions. Nothing locked behind a paid tier. And your messages can only be read by the people you sent them to.
Everything you already do every day — on a server nobody can take away from you.
AuraLeaf is the app your community opens every day. Here's what's inside it.
Nobody can read your messages but you
Not me. Not your own server. Not anyone who breaks into it. Your messages are scrambled on your device before they’re sent, and only the people you sent them to can unscramble them — in DMs, group chats and channels alike. It’s on by default, and there’s no way to turn it off.
Voice that sounds good
Your fan, your keyboard, your dog in the background — filtered out on your own computer, before anyone hears it. Your voice never gets sent somewhere else to be cleaned up. Calls are scrambled the same way your messages are.
Go live, right where you already are
Start streaming in a voice channel and everyone in it can watch — full quality, picture-in-picture, no switching tabs, no leaving the community. A LIVE badge shows up in the channel list so people know you’re on.
If this project stops, your community doesn’t
Your community lives on a server your community owns — not mine. If I disappeared tomorrow, it would keep running exactly as it does now. You can take your data out whenever you want, and the app’s source is public for anyone who wants to pick it up and carry on.
Events & calendar
Plan game nights and meetups. People RSVP so you know who’s coming, you choose which roles can see an event, and it announces itself in the right channel.
Plan game nights6 hand-tuned themes
Soft Green, Dark, Light, OLED Black, Midnight, and Nord — each designed for comfort, switchable in one click and remembered across sessions.
Your lookEncryption and security are not an afterthought — they're the foundation.
Your community keeps its own data, so protecting it is on me. Everything is locked on the way between you and the server — and your messages go further than that: in DMs, group chats and channels, only the people you sent them to can read them. Not even your own server can.
Want the technical details — which encryption, which algorithms, and an honest list of what it doesn’t protect? It’s all on the security page, and the app’s source is public to read right now.
- Nobody can read your messagesnot me, not your community’s server, not anyone who breaks into it
- Your calls are scrambled toothe machines that carry your voice can’t listen to it
- Sealed on the way thereeverything between you and the server is locked, twice over
- A second step when you log inwith spare codes in case you lose your phone
- Passwords stored the hard wayscrambled with a method built to be slow and expensive to crack
- Backups and files are encrypted toonot just your messages
- Your login can’t be liftedsessions are tied to your device and rotate on their own
- Nothing is trackedthe app never reports back on what you do or who you talk to
See it in action.
Two short tours, recorded on the real app: one for people joining a community, one for the people running it.
AuraLeaf in 3 minutes
Joining a server, chat, threads and pictures, voice and the soundboard, going live, messages and calls, events, and your profile, on your computer or your phone.
A tour for server owners
Every part of Server Settings in order: channels, roles and permissions, members and invites, moderation, emoji and sounds, events, bots, storage and voice relays.
On your phone? Watch the 1-minute version. Videos play from YouTube when you press play.
Six themes, tuned by hand.
Every theme is a full, deliberate palette — not a colour swap. Pick a theme below and flip through real screenshots of the same views in each one. Click any shot to zoom in.
Six complete themes, switchable in one click and remembered across sessions.
A family of four, working as one.
AuraLeaf is the app you use. Behind it are three more pieces that make a community run. You only need to care about these if you’re the one running the server.
AuraLeaf — the app
What everyone installs to join their community.
The app →AuraTree — the server
The computer your community’s chat actually lives on.
Server →AuraBranch — voice relays
Extra capacity, so calls stay clear for people further away.
Relay →AuraCanopy — federation
Lets separate communities link up and talk to each other.
Federation →One person. You can check that.
AuraLeaf is designed and built by one person — DemonFiend — pair-building with AI. That’s not a gimmick; it’s the reason a one-person project ships encrypted messages, live streaming, noise suppression, linked communities and six themes. The AI writes a lot of the code. I decide what’s worth building, and whether it’s good enough to ship.
You don’t have to take that on trust. The app’s source code is public, commit by commit, with the AI credited as co-author on the commits it wrote. Read it before you trust it — that’s rather the point.
It also means there’s one person accountable for this, who reads every bug report. That’s the part a company can’t copy, and it’s the reason the whole thing is built so it doesn’t need me to keep running. More about that →
Somebody owns the server. It could be you.
Most people never need this — you join a community and that’s it. But if you want to run one, AuraLeaf communities live on a server someone in the community owns. No monthly bill, no member limits, no features held back.
Running your own opens in stages. Through the alpha I host the only server — it keeps testers off broken builds while things are still changing weekly. Selected communities get their own in the beta, and it opens to everyone at release.
- Set up in one goOne command brings the whole thing up — chat, voice, file storage and notifications.
- It lives on your hardwareMessages, files and voice stay on a machine you control. Take a copy out, or delete the lot, whenever you like.
- Nothing costs moneyEvery feature, free, with no paid tier above it. No paywalled voice quality, no upload limits to buy your way out of.
- Grows with youAdd capacity as the community gets bigger, or link up with other communities running AuraLeaf.
The roadmap.
No promises on timelines — I ship it when it's ready. Here's the current shape of things.
-
1
Now · alpha
It’s built
- The app runs on Windows with everything in it: text, voice, video calls, live streams, events and six themes. Messages and calls are encrypted, and communities can link up with each other.
-
2
Next · Jan 2027
Private Alpha
- Invites go out January 1, 2027 — the alpha starts January 4, 2027. Sign up
- Invited testers get the app for Windows, Ubuntu or Android, and a community server to use it on.
- Windows is the main build: new features and fixes land there first, then on Ubuntu and Android. A small app for phone notifications comes after that.
-
3
After that
Finishing what's already built
- Push-to-talk and voice hotkeys in the desktop app.
- Voice channels shared between linked communities — these are built, and being tested before they get switched on.
- Ongoing security work across the whole thing.
-
4
Later
Other languages
- Translating the app so it isn’t English-only.
FAQ.
What is AuraLeaf?
The difference is where it lives. Instead of everything running on one company’s computers, your community runs on its own server. That means nobody can put your features behind a subscription, change the rules on you, or shut your community down.
Do I have to set anything up?
https://chat.example.com.Someone in your community runs the server, and for most people that’s never you. Your account lives on your community’s server — there’s no account with us to sign up for, because there’s no “us” in the middle.
Do I need to be technical to use it?
There is a technical side to AuraLeaf — the server, the encryption, the hosting — but none of it is your problem as a member. It’s there so the person running your community has real control, not so you have homework.
Can anyone read my messages?
Your messages are scrambled on your device before they’re sent, and only the people you sent them to can unscramble them. The server stores them scrambled and won’t accept them any other way. It’s on by default in DMs, group chats and channels, and there’s no way to turn it off. Voice and video calls are scrambled the same way.
What does AuraLeaf know about me?
Your account exists on your community’s server, not on any system I run. I don’t have a list of AuraLeaf users, because there isn’t one.
What happens to my community if you stop working on this?
Your community runs on a server you control, not mine. If I disappeared tomorrow it would keep running exactly as it does now. You can take your data out whenever you want, the app’s source is public to read, and the license lets anyone pick it up and carry on.
That’s most of the reason it’s built this way.
How is this different from Discord?
AuraLeaf has no paid tier and no ads, because it isn’t a business that needs your attention. Every feature is free, your messages can’t be read by anyone — including me — and your community’s data sits on a machine your community owns.
The honest trade-off: Discord has millions of people and years of polish. This is one person’s project, in alpha. If you want the full comparison including where AuraLeaf falls short, it’s here.
Can I move my community over from Discord?
There’s no one-click import — you set your server up the way you want it, bring your emoji across, and invite your community in. Most communities that move do it gradually: stand the new server up, run both for a few weeks, and move the things people actually show up for — game nights, voice, announcements — across first. Hard-cutting rarely works; running in parallel almost always does.
Old history stays on Discord. It can’t come with you, because AuraLeaf encrypts everything on your device before it’s sent — there’s nowhere to put unencrypted history. Clean start, and from day one nobody outside your community can read a word of it.
Is it free? What’s the catch?
The only limit is commercial use: selling it, selling access to it, or running it inside a business you’re paid for needs a separate license. Running a community that takes donations, has a Patreon, or sells a supporter role to cover its own costs is fine — that’s a community paying its bills, not a business. If you’re not sure which side you’re on, ask me — mention “commercial license” in the signup form. I’d rather answer than have you guess.
When can I actually use it, and how do I get in?
After the alpha comes a beta — also invite-only — and then a public release that anyone can try. There’s no fixed date for those; it ships when it’s ready.
Where do I download it?
What if I lose my phone or my computer?
Keep that recovery code somewhere safe — without it or the passphrase, nobody can recover those messages. Not even me. That’s the point, but it does mean it’s on you.
Can I share the app with a friend?
If a friend wants in, send them to the signup form and they can name the community that invited them.
Can I be in more than one community?
Which platforms does it run on?
How many themes are there, and can I switch them?
Join the Private Alpha.
The first wave starts January 4, 2027, with invites going out January 1. Sign up now and you'll be first in line for the app (Windows, Ubuntu or Android) and a spot on the alpha community server — and you'll help shape what ships in v1.0.
Server
AuraTree
The self-hosted voice & text community core. One Docker stack runs your whole community — messaging, voice and video, management, events, storage, and distributed voice. Built on Fastify 5, Socket.IO, PostgreSQL, Redis, MinIO, and LiveKit.
Watch: a tour for server owners
Eleven minutes through every part of Server Settings, recorded on a real server.
Messaging
Real-time text, rich and searchable
Everything a community actually does in text, with the parts that usually get bolted on later already in place.
- Real-time messaging over Socket.IO, with edit, delete & threaded replies
- Emoji reactions, pinned messages & a pinned panel
- Message search with author, date & attachment filters and highlighted results — metadata is matched server-side, message text in your client, so end-to-end-encrypted content is never indexed on the server
- File attachments with type/size validation, typing indicators & unread tracking
- Mention autocomplete, unread counts & GIF search — Giphy or Klipy, chosen per server by your admins and proxied through your own server
Voice & Video Live
LiveKit WebRTC, with regional relays
Voice and video run through LiveKit, with optional AuraBranch relays so members in other regions get a nearby endpoint instead of a transatlantic hop.
- Voice channels, video & screen share (permission-based)
- Full-screen stream viewer overlay with host preview & picture-in-picture
- Live viewer count, minimize to audio-only, quality selection (720p / 1080p / Native)
- DM voice calls & temporary voice channels (auto-cleanup when empty)
- AFK channel auto-move, participant management, limits & bitrate config
- Soundboard & custom per-user/per-server join & leave sounds
Server Management Live
Full control, granular permissions
Roles, permissions and moderation are server-side and audited, so what an admin can do is a policy decision rather than a client-side honour system.
- Bitflag permissions (server/text/voice) + role & user overrides
- Role templates, kick/ban/timeout, invites with expiry & max uses, ownership transfer
- Role reactions (self-service roles via emoji), welcome & announcement channels, server popups
- Custom emoji packs (up to 500) & stickers (up to 50) per server, drag-and-drop channel layout
- Audit logging of every admin action — kick, ban, role and channel changes — filterable by action type and target
Events & Storage
Calendar + a real storage dashboard
Two things communities outgrow fastest: scheduling, and knowing where the disk went.
- Events with RSVP, role-based visibility & announcements
- Per-category storage stats, limits & threshold alerts
- Retention policies, dry-run purge & scheduled cleanup
Direct messages
Private, encrypted, with calls & group DMs
DMs are the part you cannot read as an operator, by design — worth being clear about with your own members.
- Friend system: send/accept/reject requests, blocking, DM channels auto-created on friendship
- End-to-end encrypted DMs and group DMs — sealed to each member's devices with a fresh key per message; the server can't read them
- Encrypted DM voice calls, encrypted file attachments, and read position synced across your own devices
Experience
The day-to-day details
The small things that decide whether people stay in the app all day.
- 6 themes (Soft Green, Dark, Light, OLED, Nord, Midnight) — the same hand-tuned palettes as the desktop app
- Command palette (Ctrl+K), in-channel message search, presence & custom status
- Encrypted data export — your client decrypts what it holds and writes a passphrase-protected file (the server can't export what it can't read)
- Self-service account deletion — confirm by email, then a cancellable 14-day grace period. After that your account and personal content are erased and your posts are unlinked from you, rather than deleted outright, so conversations don’t develop holes
Infrastructure
Built to run, scale & self-heal
Designed so a single person can operate it without being paged at 3am.
- Auto-migrations, gateway with resume & gap detection
- Message archiving to MinIO cold storage (gzip)
- Self-hosted ntfy push — content-free wake signals only, never message text — plus health & version endpoints and idempotency keys
- Media encrypted at rest in MinIO, and a one-command GPG-encrypted backup script (AES-256, daily + weekly rotation)
How it all fits together.
A single AuraTree stack powers your community. AuraBranches extend voice to new regions, and AuraCanopy weaves multiple trees into one federated whole.
The admin panel, page by page.
Every management surface in AuraTree, captured from the real app — members, roles, channels, expressions, integrations, and insights. Click any shot to zoom.
Running one, in detail.
For the person deciding whether to host. Technical answers, because this reader asked for them.
When can I run my own server?
The setup docs are public now so you can see exactly what you would be taking on.
What actually runs in one stack?
docker-compose stack brings up the API (Fastify 5 + Socket.IO 4), PostgreSQL 16, Redis 7, MinIO for file storage, LiveKit for voice and video, and a self-hosted ntfy relay for push notifications. Migrations run automatically on boot.What hardware do I need?
Honest caveat: these are not load-tested numbers. Capacity planning for larger communities is something to work out together during the beta rather than a figure to quote at you now.
Can I read my users’ messages?
This is worth being clear about with your own members: you are not a moderator who can read private messages, and you cannot become one.
So what can the server see?
Attachments and media are encrypted at rest. The live database is not encrypted at rest — its contents already are, message by message.
What happens when a user deletes their account?
DELETE_GRACE_DAYS). After that the account and its personal content are erased and their posts are unlinked from them, rather than deleted outright, so conversations do not develop holes.How do backups work?
docker/backup.sh) produces GPG-encrypted backups (AES-256 symmetric) with daily and weekly rotation, piping pg_dump and a MinIO tarball straight into GPG so nothing touches disk in the clear. Two volumes hold your real data: postgres (messages, users, roles, config) and minio (attachments, emoji, stickers, profile media, archives).How do updates and migrations work?
This is part of why self-hosting is gated during the alpha — self-hosters would be stranded on broken versions.
Do I need an AuraBranch relay?
What is AuraCanopy, and do I have to use it?
Can I charge for access, or use this at work?
A community that takes donations, has a Patreon, or sells a supporter role to cover its own costs is fine — that is a community paying its bills, not a business. If you are unsure which side you are on, mention “commercial license” in the signup form and I will get back to you.
What ports do I need open?
rtc.port_range in your livekit.yaml.Is the source available?
Run AuraTree in minutes.
One docker-compose stack brings up the whole platform.
The app
AuraLeaf
Got an invite from your community? AuraLeaf is the app you join with — text, voice, video calls, and screen share with your people, all in one place, on your community’s own server. Currently in private alpha.
Watch: AuraLeaf in 3 minutes
A quick tour of the app, recorded on the real thing. 1-minute version for phones.
Joining your community
Five steps, once your invite arrives
- 1. Get your alpha invite (sign up here) and install AuraLeaf
- 2. Launch the app — you’ll see the connection screen
- 3. Enter your community’s server address — your community sends you this (it looks like a normal web link, e.g.
https://chat.example.com) - 4. Create your account there, or log in
- 5. You’re in — say hi.
No account with a big platform: your account is created on your community’s own server and exists only there. Full access to text, voice, video and screen share comes with it.
This is AuraLeaf.
Sign-in, friends, notifications, the bug reporter, and every settings page — real screenshots on the default theme.
The little things in a conversation.
Pinned plans, search, the emoji and GIF pickers, code blocks, the message menu, and the safety number you can compare with a friend — real screenshots on the default theme.
Made for small screens too.
AuraLeaf's phone layout: channels in a drawer, messages full width, settings one tap away. It's the layout the Android app uses.
Everyday use
What it’s like once you’re in
- Text, voice, video calls and screen share — the whole community in one app
- Clear calls: AI noise suppression filters out fans, keyboards and background chatter right on your device, so your voice is never sent off to a cloud to be cleaned up
- Share just one app’s audio instead of your whole system (Windows), or go live in a voice channel and everyone can watch without leaving
- Notifications that behave: unread indicators, mention badges, system tray, and auto-launch with Windows
- Six hand-tuned themes — pick the look you like, and it’s remembered
- In more than one community? Connect to them all and switch between them instantly
Who can’t see your stuff.
Private by default — it’s how the app works out of the box, not a setting you have to find.
- Big platforms can’tYour community lives on its own server — run by your community, not a corporation — and your account exists only there.
- I can’tThe app never reports back on what you do — no usage stats, no tracking of any kind. And if this project ever makes money, it’ll be from business licenses — never from your data.
- Even your own server can’t read your messagesDMs, group DMs and channel messages are all end-to-end encrypted — locked on your device before they leave it. The server only ever stores scrambled data, and refuses to accept anything else. It’s mandatory, not a toggle.
The honest print: your community’s server still runs the community — who’s a member, who’s online, which voice rooms exist. It knows that a conversation happened; it just can’t read it. Calls are scrambled too, so the machines carrying your voice only ever handle scrambled audio.
And on your own device
- Your login is stored encrypted, and the app can’t touch the rest of your files (it runs in a sandbox)
- Lose your device, not your messages — your keys can be backed up encrypted, unlocked by a passphrase or a one-time recovery code the server never sees
- GIF search goes out through your community’s server, so the GIF provider only ever sees the search term — never you
Curious how deep it goes — or what’s still on the roadmap? Read the full security details →
Talking across communities
When communities link their servers
- See & talk to people in other linked communities
- Announcements from linked communities arrive right in your server
- DM people from another community once you add them — group DMs cross over too, end-to-end encrypted
- Your community decides what it shares, and can leave the canopy at any time
This is AuraCanopy — federation between communities, and it’s built into every server.
Status & requirements
Where the app is today
- Windows alpha — expect rough edges & missing features; invite-only, starting January 4, 2027
- Ubuntu (LTS) & Android builds in the alpha too; updates install themselves in the background
- Feedback via the in-app bug reporter (
Ctrl+Shift+B) and the alpha community server
| Windows (alpha) | Minimum | Recommended |
|---|---|---|
| OS | Windows 10 (1809+) | Windows 11 |
| CPU | Dual-core x64 | Quad-core x64 |
| RAM | 4 GB system / 750 MB free | 8 GB system / 1 GB free |
| Disk | 700 MB install | 1 GB install |
| Network | 256 kbps voice / 1 Mbps share | 1 Mbps voice / 4 Mbps share |
Typical RAM in testing: ~485 MB idle, ~600 MB in a voice call. Ubuntu and Android requirements are listed with those builds.
Get the AuraLeaf app.
The Windows app ships to Private Alpha testers on January 4, 2027 — invites go out January 1. More platforms follow.
The signup asks only for an email — everything else is optional, and the email is used for one thing: sending your invite.
Relay
AuraBranch
The extension layer. Stand up extra voice regions and backup nodes wherever your community needs them. Each branch auto-pairs to the master and handles its own voice auth, heartbeats, and event relay.
Distributed voice
Lower latency, more capacity, real redundancy
- Standalone relay server that runs on its own box, anywhere
- Per-region voice routing so members connect to the nearest node
- Backup capacity — keep voice up when a node drops
- Channel relay policies:
master,auto(best by latency/load), orspecific(pinned)
Pairing & health
Secure, self-monitoring
- Secure pairing via ECDH key exchange + one-time tokens
- Heartbeat health monitoring with auto-failover
- Admin lifecycle: create, suspend, drain, delete
Federated Relays Future
A branch reserved just for the federation
- Stand up a relay specifically for AuraCanopy to use
- Offload federation voice so one already-taxed server isn't carrying it
- Built and in hardening — switched off by default until the relay subsystem is production-ready
Extend voice beyond one machine.
AuraBranch ships with the server's relay package.
Federation
AuraCanopy
The layer that connects AuraTrees. Many trees, acting as separate servers that still share resources — so users across communities can join and see each other, talk in shared federated channels, and DM across servers. It's not a separate service you deploy; it's the connective tissue between your trees.
What federation does
Separate servers, one shared community feel
- Users on different trees can join and see each other
- Each tree keeps its own identity, data & ownership — nothing is merged into a single monolith
- Scale a community across multiple servers without sacrificing independence
Federation announcements
Broadcast to the whole canopy
- Post in a federation announcement channel and it fans out into every federated server's own announcement channel
- Edits, deletes and per-server rate limits propagate with it
- Each tree opts in per channel and decides which of its members appear across the canopy
Cross-server DMs
Private, across the canopy
- When users on different trees add each other, they get a DM — group DMs work across the canopy too
- Friend requests & DMs work across the federation, delivered as end-to-end encrypted envelopes neither server can read
- Shared ban lists: the federation owner curates one, and each tree auto-applies it or reviews a queue — matching uses salted hashes, never raw emails
Federation permissions
Because it connects trees, it's a critical control surface
- Permissions govern who can join a federation and what they can broadcast
- Each tree controls what it shares with the canopy
- Federation is a connective layer, not a separate service — but it carries its own permission model because it bridges independent servers
Security & privacy
Federation stays encryption-first
- Cross-server data exchange is encrypted, consistent with the platform's ECDH + AES-256-GCM model
- No tree hands over ownership of its data to the federation
Federated Relays Future
Dedicated AuraBranch capacity for the canopy
- Stand up a relay specifically for the federation to use
- Keep federation voice off an already-taxed server
- Built and in hardening — switched off by default until the relay subsystem is production-ready
Federation, hands on.
Your networks, voice relays shared between servers, and the Canopy panel that shows federated servers beside your own member list — how the canopy looks from a server owner's chair.
Many trees. One canopy.
Federation is live in AuraTree — AuraCanopy ships inside every server. Join the alpha to try it.
Encryption and security are not an afterthought — they’re the foundation.
Your community hosts its own data, so protecting it is on me. AuraLeaf is built encryption-first: messages are end-to-end encrypted by default, calls are frame-encrypted, credentials are hashed the strong way, and nothing about your usage is phoned home.
End-to-end encryption
Mandatory, not a toggle
- Every message is end-to-end encrypted — DMs, group DMs and server channels alike. The server stores nothing but ciphertext and rejects plaintext writes; even a server you run yourself can’t read them.
- DMs: each message is sealed to every one of the recipient’s devices with a fresh
ECDH(P-256) exchange andAES-256-GCM— a new key every time. Private keys never leave your device’s secure storage. - Channels: rotating sender keys mean someone who joins can’t read history from before they arrived, and when a member leaves, keys roll so they can’t read anything after.
- Encrypted voice & video — SFrame frame encryption on DM calls (fail-closed: the app refuses to join a call it can’t encrypt), on federation voice, and on server voice channels by default. The media servers and relays only ever carry ciphertext. To be precise: voice and video frames use
AES-128-GCM(SFrame’s default), not theAES-256-GCMused for messages. - Encrypted key backup — back your keys up with a passphrase or a one-time recovery code. The blob is encrypted on your device before upload; the server can never decrypt it. A lost-device hedge, not escrow.
Accounts & sessions
Getting in, safely
- Two-factor authentication — TOTP with QR enrollment, ten single-use backup codes, encrypted secrets and replay protection
- Argon2 password hashing (memory-hard, resistant to GPU/ASIC attacks), with lockout after repeated failures
- JWT access tokens + httpOnly refresh cookies with rotation, and per-device session management
- Encrypted credential storage for “remember me”, sealed by your OS keystore; the app runs in a locked-down sandbox
In transit & at rest
On the wire and on the disk
- TLS everywhere, plus a per-session
ECDH+AES-256-GCMpayload layer that fails closed rather than downgrading - Media encrypted at rest — attachments, emoji, stickers and archives are stored encrypted by MinIO
- GPG-encrypted backups (AES-256) that never touch disk in the clear, with daily and weekly rotation
- Your local message cache is sealed on disk under a key held in your OS keystore
Data that never leaves
What I don’t see, and nor do third parties
- No telemetry — no analytics or tracking SDKs anywhere. Crash and bug reports go to your own server, never to me. The desktop app’s one outside call is checking for its own updates.
- Content-free push — your self-hosted push relay only ever receives an opaque wake signal, never message text, sender or channel names
- GIF search is proxied by your server, so Giphy or Klipy only ever see the search term — never your members’ accounts or addresses
- Self-service account deletion with email confirmation and a cancellable 14-day grace period
Relay security
AuraBranch pairs securely
- Relay pairing via secure ECDH + one-time pairing tokens
- WebSocket signaling proxied through the master’s SSL (no mixed content)
- Federation traffic is signed with each server’s own key, so peers can’t be impersonated or replayed
Abuse & access
Defense in depth
- Per-endpoint rate limiting
- Admin claim-code system & session management
- Audit logging of every admin action
Honest limits
What I don’t claim
- Your community’s server holds the things that run the community — accounts, memberships, presence, and message metadata. End-to-end encryption covers message content; it doesn’t make you anonymous to your own server.
- Call encryption keys are minted by your community’s server, so the honest claim is that the media servers and relays never see plaintext — not that your own server couldn’t.
- The live database itself isn’t encrypted at rest (its contents already are, message-by-message). Backups and media storage are.
- Stored 2FA secrets are encrypted, but unless the operator configures a dedicated key the server derives one from its
JWT_SECRET— so key separation there depends on how the server was set up. - No third-party security audit yet. You don’t have to take my word for the client, though: the AuraLeaf app and the AuraBranch relay are public source right now — read them. The server stays private while the rollout is staged.
Your data stays yours.
Get AuraTree running.
This is the canonical public reference for running an AuraTree server. The server repository is private while the rollout is staged, so what follows is the document of record.
Prerequisites
- Docker & Docker Compose
- Node.js 20+ (for development)
- pnpm 8+ (for development)
Production deploy
The whole platform runs from a single docker-compose stack. Copy the env file, edit it, then bring the services up.
# 1. Configure environment
cp docker/.env.example docker/.env
# edit docker/.env with your settings
# 2. Start all services
cd docker
docker-compose up -d.env.example file in the repo documents every variable — compose refuses to start if a required one is missing. LiveKit also reads a config file you place at /opt/auratree/livekit.yaml.Portainer
Deploying through Portainer instead of the CLI? Add a new stack, paste the contents of docker/docker-compose.yml, and fill in the env file values on the stack form. The livekit service runs on the Docker bridge network with its ports mapped — make sure TCP 7880/7881 and UDP 50000–50100 (the compose default; it must match rtc.port_range in your livekit.yaml) are open on the endpoint machine for WebRTC.
Backups
Two volumes hold your community's actual data:
postgres— all messages, users, roles & server configminio— attachments, emoji packs, stickers, profile media, archived messages
The server ships docker/backup.sh: it pipes a nightly pg_dump and a tarball of the MinIO volume straight into GPG (AES-256 symmetric), so backups never touch disk unencrypted, and rotates them automatically — seven daily, four weekly. Schedule it with one cron line; the script prints the exact restore commands. The in-app encrypted export is a good second net for individuals.
Docker services
The stack brings up these containers. This is what you'll see in Portainer once deployed.
| Service | Image | Port | Purpose |
|---|---|---|---|
api | sosiagaming/auratree-api | 3040 | API + web client |
postgres | sosiagaming/auratree-postgres | 3041 (localhost) | Database |
redis | redis:7.4-alpine | 3042 (localhost) | Cache, sessions |
minio | minio/minio | 3043 (S3) · 3044 console | File storage, encrypted at rest |
livekit | livekit/livekit-server | 7880–7881 + UDP 50000–50100 | Voice/video SFU |
ntfy | binwiederhier/ntfy | 3048 (localhost) | Push notifications |
Three things face your users, each behind a TLS reverse proxy (Caddy/Nginx/Traefik): the api port (3040), MinIO's S3 port (3043, for attachments), and LiveKit signaling (7880) — plus UDP 50000–50100 open for WebRTC media. Postgres, Redis, the MinIO console and ntfy stay on localhost. Note that ntfy ships locked down: create a publish token and set NTFY_URL to switch push on.
Relay networking (AuraBranch)
When deploying relay servers on the same LAN as the master, the relay must report a reachable IP address — not localhost. The master's API container proxies LiveKit WebSocket signaling through its own SSL, so the relay's livekit_url must be reachable from inside the Docker container.
localhost resolves to the container itself, not the host. Set PUBLIC_IP or LIVEKIT_PUBLIC_URL to the relay machine's LAN IP.# Example: relay on the same LAN as the master
LIVEKIT_PUBLIC_URL=ws://192.168.1.50:7880Development
# Install dependencies
pnpm install
pnpm dev # API dev server (port 3000)
pnpm dev:web # web client dev server (port 5174)
pnpm dev:all # both at once
pnpm build # build all packages (shared -> web -> api)
pnpm typecheck # type check
pnpm lint # lintProject structure
Aura-Tree/
├── packages/
│ ├── shared/ # types, validators, permissions, constants
│ ├── api/ # Fastify backend + Socket.IO
│ │ └── src/ # routes, socket, services, lib, middleware,
│ │ # migrations, plugins
│ ├── client/ # React 19 app — desktop UI (own repo, submodule)
│ ├── web/ # Vite wrapper: builds the client for the browser
│ └── relay/ # standalone relay server CLI (AuraBranch)
│ └── src/ # auto-pairing, crypto, heartbeat,
│ # voice auth, event relay
└── docker/
├── docker-compose.yml
├── Dockerfile.api
├── Dockerfile.postgres
├── backup.sh # GPG-encrypted nightly backups
└── init.sqlAuraLeaf client
The desktop app lives in its own repository, and it is fully public — clone and read it today. It's an Electron + React + Mantine + Vite app that talks to any AuraTree, and the same codebase is compiled for the browser as the web client.
What the client adds over the web client
- Per-app audio capture on Windows (stream one app's audio, not the whole system)
- System tray, auto-launch with Windows, and a global bug-report shortcut (global voice hotkeys are being wired)
- Multi-server switching, native notifications with mention badges
- AI noise suppression on-device: RNNoise (Standard) or DeepFilterNet3 (High Quality)
Current status
- Private alpha — invite-only, starting January 4, 2027, on Windows, Ubuntu (LTS) .AppImage and Android APK
- Windows is the main build: new features and fixes land there first, then on Ubuntu and Android
- Auto-update is built in (electron-updater): updates download in the background and install on quit
- Per-app audio capture is Windows-only; other platforms fall back to system audio
Bug reports go through the in-app reporter (Ctrl+Shift+B); feature requests live on the alpha community server.
Licensing
AuraLeaf uses a dual-license model:
- PolyForm Noncommercial 1.0.0 — free for personal, hobby, educational, research, and other non-commercial use. Read the source, fork it, modify it, contribute back.
- Commercial license — required to sell it, offer it as a paid service/hosting, bundle it into a product you sell, or otherwise use it in a for-profit business. Reach out through the signup form — mention “commercial license” in the message box.
Known limitations
Screen-share audio capture (browser)
The getDisplayMedia() API has inherent limits on audio capture:
| Share type | Audio behavior |
|---|---|
| Browser tab | Captures tab audio only |
| Window | No isolated app audio (system audio or nothing) |
| Entire screen | Captures all system audio |
Browsers don't expose per-application audio routing for privacy/security. The Electron desktop client (AuraLeaf) provides better audio capture.
Join the Private Alpha.
AuraLeaf's first testers get the app for Windows, Ubuntu or Android, a hosted community server to hang out on, and a direct line to shape what ships in v1.0. Spots in the first wave are limited — signing up early puts you at the front of the queue.
It goes alpha, then beta, then release. Both the alpha and the beta are invite-only — you get in by signing up and being accepted. Anyone can try it without an invite at release. A public demo is planned, but there’s no date for it yet.
You're on the list.
Watch your inbox on January 1, 2027 — that's when invites go out. The alpha itself starts January 4.
How it works
- 1 · Sign upThirty seconds with the form. I read every request by hand.
- 2 · Approved testers get an invite email — Jan 1, 2027Your private tester account and the download link for the Windows client.
- 3 · The alpha begins — Jan 4, 2027Install, connect, and use it for real. Joining a community in the alpha? Pick it in the form so I can route your invite.
- Please don’t pass builds aroundEverything changes weekly, and old copies break in confusing ways that waste your time and mine. Access is per-person, through your own account, so everyone is on the build I can actually debug.
How the Alpha works.
The short version of life as a tester — reporting bugs, asking for features, and what to expect from updates.
How to report a bug
Built into the client — no forms, no external tracker
- Press
Ctrl+Shift+Banywhere in the app, or click the bug icon in the title bar - Give it a title, say what went wrong, and choose whether to attach a screenshot — the toggle is right in the form, so untick it if the capture shows anything private
- Reports land directly with the developer, with the technical context attached. Rough repro steps ("I clicked X then Y") make fixes dramatically faster
How to request a feature
Loud opinions genuinely welcome
- Post it in the
#feature-requestschannel on the alpha community server — discussion happens there first - Bigger ideas: file them on the tracker with your tester account, so they don't get lost in chat scroll
- Every request gets read. "This annoys me daily" carries more weight than "wouldn't it be cool if" — say which one it is
Release cadence
What updates look like during the alpha
- One hotpatch a week is the target — fixes and small features, installed via the normal updater
- Updates that need a database wipe are held for the last week of each month — and if no wipe is needed, it doesn't happen
- Honesty clause: sometimes a mistake leaves data in a bad state, or encrypted data simply can't be migrated. When that forces a wipe, it'll be announced on the alpha server first
How long does the alpha run?
No countdown clock on this one
- There's no set end date. Aura is built by one person in their spare time, and it ships when it's ready — not when a quarter ends
- The alpha rolls into beta when the core is stable, and your tester account carries over. The beta is invite-only too — it stays that way until release
- Builds stay per-person for the whole alpha and beta — it keeps everyone on a current build rather than a stale one
Why AuraLeaf?
There are a dozen chat apps. Here's the honest case for this one — where it's different, where it isn't, and a feature-by-feature comparison with the platforms you already know. The gaps are in the table too.
You own the whole stack
Server, media, voice, push — everything runs on hardware you control. No vendor can price-hike, data-mine, or sunset your community.
Privacy is the default
End-to-end encrypted messages — DMs, group DMs and channels — encrypted calls, zero telemetry. Not a settings page you have to find; it's how it works out of the box.
Every feature, free
No Nitro tier, no paywalled voice quality, no upload-size upsell. Free for non-commercial use — the whole thing, forever.
Federation without lock-in
Independent communities can link up through AuraCanopy — share channels and DMs across servers while every tree keeps its own roots.
Voice that's actually good
LiveKit WebRTC with on-device AI noise suppression, regional relays via AuraBranch, live streams and video in the same client.
Honest about where it is
Built in the open by one person and AI, currently in alpha. The comparison below doesn't hide the gaps — see for yourself.
How it compares
The honest version — features, control, and cost at a glance. Discord first, because that’s the real question.
| AuraLeaf | Discord | |
|---|---|---|
| Cost | Free. No paid tier above it. | Free, with subscriptions and tiers on top |
| Who holds your data | A machine your community owns | Discord’s servers, under Discord’s rules |
| Who can read your messages | Only the people you sent them to | Discord can read text; voice & video are end-to-end encrypted |
| Tracking | None | Extensive |
| Can your community be shut down? | Not by me — I don’t hold it | Yes, by Discord |
| Setup | Join in seconds; someone runs the server (that opens in stages) | Zero — sign up |
| How many people are already on it | Nobody yet. It’s in alpha. | Hundreds of millions |
That last row is the real trade-off, and no feature list fixes it. Everything else is below.
Compare against everything else — Slack, Revolt, Matrix, Mumble, TeamSpeak, Guilded, IRC, Jitsi, Signal
Comparison is a rough guide — details differ per release. Accurate as of September 2026; competitors change theirs without telling me. The AuraLeaf column you can check yourself: the app source is public.
One person, a lot of AI,
and a community platform.
The story behind AuraLeaf — and where it's headed.
AuraLeaf started as a simple frustration: the platforms our communities live on don't belong to us. Servers get banned, features get paywalled, policies shift under your feet, and your community's history sits in someone else's datacenter.
So I built the alternative I wanted: a complete, self-hosted voice & text platform — AuraLeaf (the app everyone installs), AuraTree (the server it connects to), AuraBranch (voice relays), and AuraCanopy (federation between communities). One stack, your hardware, your rules.
It's designed and coded by one person — DemonFiend — pair-building with AI, in the open. That's not a gimmick; it's the reason a one-person project ships encrypted DMs, live streaming, noise suppression, federation, and six themes. The AI writes a lot of the code; I decide what's worth building and whether it's good enough to ship. You can check that claim rather than take it: the commits are public, and the AI is credited as co-author on the ones it wrote.
The whole platform is free for non-commercial use under PolyForm Noncommercial. The app and the voice relay are public source you can read today — AuraLeaf and AuraBranch. The server stays private while the rollout is staged, which is also why running your own opens in stages: I host the only server through the alpha, selected communities get their own in the beta, and it opens to everyone at release. If this ever makes money, it’ll be from businesses licensing it, never from your data.