onyx · kept with care

A small network you can join.
A daemon you can run.

Onyx is a public community with a first-party client we keep as our sauce — and Onyx Server, the pure-Zig AGPL daemon, open so you can audit it or run a node of your own. Local-first memory, hop-in voice, tab-closed push, and a wire no company owns.

Join #root Run your own
ircs://eshmaki.me:6697 any IRC client · setup

:eshmaki.me NOTICE you :open Onyx to check the rooms

users
—
rooms
—
msgs
—
feed
awaiting feed
onyx · #root · home

since you were away

mika pinned the self-host guide

kai started a voice room in #root

vault · saved on this device · hybrid search

#root message the room…

product as hero · not a brochure

four doors in

Chat · Privacy · Self-host · Builders.

Just here to chat

Pick a nick and you’re in #root — no account, no download, no wait.

Open #root

Here for the privacy

Cloaked hosts, E2EE DMs, no ad tech — private by default, not an upsell.

Privacy, plainly

Run your own node

Download AGPL Onyx Server v0.5.6 — pure Zig, static, zero external deps, no OpenSSL treadmill. Verify the checksum, run the included quickstart, or reproduce the binary from source. The first-party Onyx client stays our sauce.

Self-host guide

Here for the source

Clean-room IRC + 1998 IRCX daemon — own TLS 1.3, deterministic-sim tested. Onyx Server is open (AGPL); the first-party client is closed sauce.

Browse onyx-server

the mesh

A serpent with two heads.
So far.

Every node carries the whole network. State replicates over Undertow, a CRDT mesh sealed by Mooring — a post-quantum ratchet between servers. When the link between them drops, both keep talking; when it returns, history quietly reconverges. And when a server upgrades, the link doesn't even blink — the live connection is handed to the new process mid-flight.

open live network status

eshmaki.me

home node

Primary node and web home — serves Onyx, the stats engine, and the browser gateway.

TLS
6697 · TLS 1.3 + PQ hybrid
Web
wss gateway for Onyx
Pulse
live check available

ircx.us

mesh peer

Second head of the serpent. Fully replicated: your account, channels, and history are here too.

TLS
6697 · TLS 1.3 + PQ hybrid
Link
Undertow · Ed25519 + X-Wing
Role
same network, same you
—people online now
—rooms with a pulse
—messages kept
2mesh nodes

the halls

What's on.

The rooms with a pulse right now — who's in them and what they're about, straight from the servers and normally refreshed every thirty seconds. Data-saving preferences pause repeated checks and leave manual refresh available. Everyone lands in #root first.

#root

home base

The network's living room — pull up a chair.

Start your own hall

Any channel you /join is yours to shape — register it with CHANNEL REGISTER, set a topic, hand out keys from the IRCX ladder. It shows up here once people start talking.

Channel guide →

the machinery

Built by hand.

The network runs Onyx Server, an IRC daemon written from scratch in Zig — no OpenSSL, no inherited C, its own TLS stack, codecs, and server mesh. The source is public. Both servers upgrade in place mid-conversation, and not just your session: the encrypted link between the servers is carried across the swap too, so a deploy lands without a single netsplit — nobody sees anyone leave.

It speaks thirty years of IRC at once: the modern IRCv3 your client expects — history, search, edits, reactions, read markers, typing — and the IRCX that Microsoft Chat spoke in 1998, key ladders and auditorium mode included. Yes, Comic Chat still works. Connect with the original client and your messages become panels.

Voice and video are part of the protocol, not a bolt-on — any room seats a call of sixty-four. Your host is cloaked by default, the key exchange is post-quantum, and there are no ads, trackers, or analytics anywhere in the stack. Accounts are plain server commands, not a chat with a robot — and if a message finds you gone, an opt-in push can still reach your browser.

daemon
Onyx Server · pure Zig
transport
TLS 1.3 · X25519MLKEM768
mesh
Undertow CRDT · zero-drop upgrades
privacy
cloaked hosts · no trackers
media
CadenceVox / CadenceVis · 64 seats
moderation
Warden · match × scope × action

Every command and detail is written down in the guides.

the shape of it

Nobody's product.

Onyx isn't a startup, a closed platform, or a funnel — it's two servers we pay for and a protocol we wrote, kept for the people who show up. That one fact quietly decides everything else.

  1. Independent

    No investors, no metric to grow, nobody to sell your attention to. When a room goes quiet, it's just quiet — not optimised.

  2. Private by default

    Your host is cloaked the moment you connect, the server links are post-quantum, your DMs can go end-to-end encrypted, and there isn't one tracker, ad, or analytics beacon in the whole stack.

  3. Open engine, public rooms

    Onyx Server — the daemon — is public, AGPL, and pure Zig. Read it, fork it, run your own node. The Onyx client is first-party product sauce (not FOSS); the network stays open to join.

  4. Built to stay up

    Accounts, history, and the mesh itself survive restarts, netsplits, and live upgrades. We ship new code without saying goodbye to anyone.

or host a node

Run your own.

The same daemon we run is Onyx Server — pure Zig, AGPL, zero external dependencies. No database to babysit, no OpenSSL to patch, no runtime to install. Download and verify the published v0.5.6 binary, point it at the quickstart config, and open ws://localhost:8080. The first-party Onyx client stays our sauce — you host the engine, not a FOSS dump of the app.

Ships with
Its own TLS 1.3, its own mesh, its own services — nothing to bolt on.
Reproducible
packaging/release.sh emits a bit-for-bit musl artifact, SBOM, and provenance you can rebuild and verify.
Licence
Onyx Server is AGPL-3.0 pure Zig — open engine, SBOM that fits on one line. The Onyx web client is separate product sauce.

Keep it standalone, or wire your node into ours over the same encrypted mesh — the daemon is public either way. Release assets include SHA-256 checksums, a quickstart config, SBOM, and reproducible-build provenance.

onyx-server · download + verify

Local eval — download, verify, then run

base=https://github.com/devinkbrown/onyx-server/releases/download/v0.5.6
curl -fLO $base/onyx-server-0.5.6-x86_64-linux-musl
curl -fLO $base/onyx-server.quickstart.toml
curl -fLO $base/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
chmod +x onyx-server-0.5.6-x86_64-linux-musl
./onyx-server-0.5.6-x86_64-linux-musl onyx-server.quickstart.toml

The release binary is the byte-identical artifact deployed on both public nodes. Rebuild it from source with packaging/release.sh and check it with packaging/verify-release.sh when you want independent provenance.

Or Docker — build the image first, then run

packaging/release.sh                    # verified static binary → dist/
docker build -f packaging/Dockerfile -t onyx-server:latest .
docker run -p 6667:6667 -p 8080:8080 \
  -v onyx-server:/data onyx-server:latest

There’s no registry image to docker pull yet — you build onyx-server:latest locally from source. The named volume keeps your node key and account store.

  • irc://localhost:6667 — any IRC client (open path)
  • ws://localhost:8080 — WebSocket endpoint (browser client you control)

Your node’s identity key and account store are generated on first run — nothing else to configure for local eval. Daemon boot is quick once the verified binary exists. Onyx Server is open (AGPL); the first-party Onyx app is closed sauce and is not inside this package.

getting in

The door isn't locked.

The browser way or the client way — both land in the same rooms. Guests are welcome; register only if you feel like staying.

In the browser

Onyx runs right here — chat, voice, video, and an installable app shell when you want it on your dock or home screen. Pick a nick and you're in.

In your own client

Anything from 1996 onward. TLS on 6697; SASL when you have an account. WeeChat, for instance:

/server add onyx eshmaki.me/6697 -tls
/connect onyx
/join #root

irssi, mIRC, SASL details, and password-free certificate logins are all in the guides.

Staying a while?

/REGISTER you your@email password protects your nick and unlocks personas, two-factor, and session sync across devices — the accounts guide walks through it.

the people

Small network, kept with care.

Onyx is a public community on purpose — small enough to know the room, open enough to walk in. The first-party Onyx client is our sauce; Onyx Server is the open AGPL daemon. The rules fit on a napkin, and the napkin is basically one sentence.

01 · chat Join #root Pick a nick. No account, no download. 02 · privacy Private by default Cloaks, E2EE DMs, no ad tech. 03 · self-host Run your own node Download verified AGPL Onyx Server v0.5.6. 04 · builders Read onyx-server Daemon FOSS. Client stays sauce.

Be excellent to each other.

— the whole rulebook, more or less

Guides

Connecting, accounts, personas, channel keys, voice & video — all of it, written down.

Channel stats

Live dashboards for every room — activity, heatmaps, top chatters, topic history.

House rules

The napkin, unfolded — what flies, what doesn’t, and how moderation works here.

Server status

Is it up? Node uptime, mesh link health, and who’s online — straight from the daemon.

Install Onyx

Run Onyx as its own window on your dock or home screen — local memory, offline drafts, and quiet updates.

Accessibility

Where we keep score on keyboard access, motion controls, and contrast — the audits, in the open.

Glossary

Plain definitions for the words we use — Onyx, invites, accounts, local memory, and the protocol underneath.

Integrations

Webhooks, imports, bridge status, and migration paths — the ways in, and the ways out.

Agent safety

How we treat AI agents in the rooms — provenance labels, private data kept out, every action on the record.

Get help

Ask in #root, or mail admin@eshmaki.me. A human answers both.

Run your own

Download and verify Onyx Server v0.5.6, or reproduce it from source. Stand up a node; the Onyx app stays our sauce.

Source & licence

AGPL pure-Zig daemon on GitHub — audit it, fork it, open an issue. Engine open; client closed.