Client, host and community
The client runs in a browser; the desktop shell uses Tauri. The API uses Node.js/TypeScript and host data is stored in PostgreSQL. Files use S3-compatible storage; media uses LiveKit when configured.
A host manages accounts and its infrastructure. A guild is a community with roles and channels within that host. One host can serve several communities.
Federation
Independent hosts exchange signed requests. Addresses use @username#hostname; federation uses Ed25519 keys and replay protection. Sibrel has its own protocol and is not directly compatible with Matrix.
- Cross-host groups have a home host; membership changes and synchronization depend on its availability.
- Fallback message relay follows failed direct delivery. It does not relay audio/video or guarantee delivery to a completely offline host.
- Relay is limited to an operator-configured share of outgoing bandwidth, not automatically measured spare capacity.
- A signature verifies the request source; it does not encrypt the message.
Separating infrastructure
Files can use local MinIO or external S3 storage, and media can use local or separate LiveKit. The project supports additional storage and media nodes. Each room is assigned to one media node.
Automation
A bot is a separate account with permissions limited per community. REST API, WebSocket Gateway, slash commands, buttons, embeds and voice are available. Webhooks handle simple incoming notifications.
Security boundaries
New attachments from the main composer are encrypted by the client using AES-256-GCM, with file keys wrapped for recipient keys. Older attachments, avatars, public posts, emoji and stickers use a different access model.
Do not treat text messages as end-to-end encrypted. File encryption does not protect against a malicious client, a compromised device or a recipient saving a file. See the security guide.
Benefits and operator responsibilities
| Benefit | Cost and limitation |
|---|---|
| Control your host and separate services. | Administration, updates, backups and monitoring are your responsibility. |
| Federation between independent nodes. | Requires trust in operators, compatibility and working network routes. |
| A Tauri client without a separate Electron engine. | There are no universal RAM or speed benchmarks for every device. |
| A dedicated Bot API and integrations. | Bots must handle errors, revoked tokens, disconnects and API changes. |
| Configurable permissions and rules. | Self-hosting does not remove legal or personal-data obligations. |