Saivo

Home node

Your own relay, as a feature of the app instead of a server project.

Run a home node

  • On the Linux desktop: Settings → Your own server → Be my home node. Saivo starts saivo-home for you, uses it as your relay and shows the address to give your other devices. The choice is remembered and restored when the app starts.
  • On a spare PC, NAS or Raspberry Pi: run saivo-home. No flags, no Docker, no domain. It creates ~/.local/share/kaiku-home (database, attachments, an owner-only admin-token), listens on 0.0.0.0:8765, announces itself on the local network and prints the addresses. SAIVO_BIND_ADDR overrides the listen address; the first argument overrides the data folder.
  • The operator panel (run a relay) is on 127.0.0.1:8766 of that machine.
  • saivo-server stays the choice for a public relay with TLS and TURN.

Find it

In Settings → Relay Server Gateway, Find a home node on this network lists nodes announcing _kaiku-relay._tcp (mDNS). Tap one to fill the address.

Encrypted address without a domain (pinned certificate)

saivo-home --tls, or Home node → Encrypt the connection, makes the node serve wss:// with a self-signed certificate it creates once (tls-cert.pem, tls-key.pem, tls-pin in the data folder). Its addresses end in #pin=<sha256 of the certificate>. Apps trust exactly that certificate for that address, no certificate authority involved, so no domain or Let's Encrypt is needed. The address (with the pin) goes on your contact card, so contacts get it automatically. Wrong or missing pin: the connection is refused (tested). Limits: the pin travels with the address, so share the address over a channel you trust; an announcement on the local network is only as trustworthy as that network; a card with three pinned addresses may not fit the 255-byte relay field (the card then lists none). Older Saivo versions reject a pinned address.

Letting people outside your home reach it (UPnP / NAT-PMP)

Off by default. In Settings → Your own server, "Let friends outside my home reach it" (or saivo-home --tls --open-port) asks your router to forward the node's port. It tries UPnP, then NAT-PMP, renews the lease every 20 minutes, and removes the mapping when the node stops. It only works together with the pinned encrypted address, so turning it on turns that on, and saivo-home refuses --open-port without --tls.

When the router agrees, the dialog shows a wss://<public ip>:<port>/relay/v1#pin=... address to give to friends outside your home. The app does not switch your own card to it automatically: routers often cannot loop back to their own public address from inside.

It tells you when it cannot work: no router answers, the router refuses, or the router's outside address is a private or shared one (carrier-grade NAT), in which case it removes the mapping again and says so. A public address that changes is not followed yet; the address shown is the one at the last renewal.

Tested with a fake router (opened, refused, renewed, removed on stop, off by default, TLS required) and by checking that this machine's network has no UPnP router to answer. Not yet tried against a real router that allows it.

Circle relays

Settings → Circle relays: up to two more relays, usually another person's home node. Your contact card then lists up to three relays. Contacts publish to the first and move to the next when it cannot be reached; you receive on all of them (one receive-only connection each). Duplicates are dropped by the core. Contacts are told automatically when the list changes.

A circle relay sees what any relay sees: when you connect, from which address, and how much mail you get; not its contents.

What this does not do yet

  • Reachability across the internet is not automatic. A home node is reachable on its own network. From outside you still need a forwarded port on your router (or a tunnel). An onion address is not built. UPnP/NAT-PMP exists behind an off-by-default switch (above) but has not been run against a real router.
  • A card that names a private (LAN) address is ignored by other people's apps, by design (a card must not make an app probe your network). A LAN-only home node is for your own devices and household; set SAIVO_ALLOW_LOCAL_RELAYS=1 on the household's computers to allow it.
  • Phones do not host. Android has no switch for this and no Tor; it uses a node and, ideally, push wake-ups. Idle battery use of the circle connections has not been measured on a phone; each circle relay is one more open connection.
  • Older Saivo versions reject a card that lists more than one relay; single-relay cards are unchanged.