self-host

Run your own node. One binary.

The same daemon that runs Onyx is a single static binary with zero external dependencies — no database to babysit, no OpenSSL to patch, no runtime to install. Download the published v0.5.6 static binary, verify it against SHA256SUMS, then point it at the included quickstart config. Keep it standalone, or link it into our mesh — the daemon is AGPL pure-Zig Onyx Server. The first-party Onyx client is separate product sauce.

onyx-server · download + verify 
curl -fLO https://github.com/devinkbrown/onyx-server/releases/download/v0.5.6/onyx-server-0.5.6-x86_64-linux-musl
curl -fLO https://github.com/devinkbrown/onyx-server/releases/download/v0.5.6/onyx-server.quickstart.toml
chmod +x onyx-server-0.5.6-x86_64-linux-musl
./onyx-server-0.5.6-x86_64-linux-musl onyx-server.quickstart.toml
   node key + account store generated in ./
   ws://localhost:8080   Onyx web client
   irc://localhost:6667  any IRC client

Download, verify, then run. The node’s sovereign identity key and account store are generated on first run — nothing else to configure for local evaluation.

01

Two ways in. Download or rebuild.

Native is the shortest path: one verified binary + one config. Source remains reproducible, and Docker remains a build‑then‑run path because there is no registry image yet.

Path one · native

Static binary, ready to verify.

Download the versioned musl binary, quickstart config, and checksum manifest. The release also carries a CycloneDX SBOM and reproducible-build provenance. 

base=https://github.com/devinkbrown/onyx-server/releases/download/v0.5.6
curl -fLO $base/onyx-server-0.5.6-x86_64-linux-musl
curl -fLO $base/onyx-server.quickstart.toml
curl -fLO $base/SHA256SUMS
sha256sum -c --ignore-missing SHA256SUMS
chmod +x onyx-server-0.5.6-x86_64-linux-musl
./onyx-server-0.5.6-x86_64-linux-musl onyx-server.quickstart.toml

Boots plaintext ws://localhost:8080 + irc://localhost:6667 for local evaluation. Preflight without listeners: ./onyx-server-0.5.6-x86_64-linux-musl --check-config onyx-server.quickstart.toml.

Path two · docker

A minimal image, from the verified binary.

Build the reproducible artifact first with packaging/release.sh, then the image is just that binary plus the quickstart config on Alpine. Nothing to pull from a registry yet. 

packaging/release.sh                    # verified static binary → dist/
docker build -f packaging/Dockerfile -t onyx-server:latest .
docker run -p 6667:6667 -p 8080:8080 \
  -v onyx-server:/data onyx-server:latest

The named onyx-server:/data volume persists your node key + account store across restarts.

Both paths above are plaintext, for local evaluation. For production, swap the quickstart for a TLS config — real certs or the built-in ACME client — set ws_plain = false, and a real server_name. Prefer the packaged systemd unit (ExecStartPre=… --check-config …). Full cards live in the daemon’s packaging/README.md.

02

What ships in the box.

Everything a node needs is inside the one binary. The software bill of materials is, effectively, one line.

  • Its own TLS 1.3.

    A from-scratch, no-C-interop TLS stack — no OpenSSL to install, track CVEs on, or patch at 2 a.m.

  • Its own mesh.

    One serpent, many heads: nodes federate over an encrypted, post-quantum-hybrid link. Stand alone, or join ours — no permission asked.

  • Its own services.

    Accounts, channel registration, cloaked hosts, passkeys — real server commands, not bolted-on pseudo-clients or a second process.

  • No moving parts.

    No database server, no runtime, no dependency tree. The node’s identity key and account store are plain files in the working directory (/data in the image).

Default quickstart endpoints
EndpointFor
ws://…:8080The Onyx web client, in any browser
irc://…:6667Any standard IRC client, including thirty-year-old ones
03

Point a client at your node.

Two front doors into the exact same node. Any IRC client is the open path. The first-party Onyx browser app is product sauce — not published as FOSS, not shipped inside the daemon.

IRC · open path

Bring any IRC client.

The honest FOSS front door to a self-hosted node: any standard IRC client on localhost:6667 for the plaintext quickstart, or your TLS port in production. Same rooms, same protocol — no first-party app required. 

/server localhost 6667

Browser · sauce

The Onyx app is a separate product.

The first-party Onyx app is not published as FOSS and is not inside the daemon package. Your node still speaks WebSocket at ws://localhost:8080 — point a browser client you already control at that endpoint, or join the public network with the hosted app at eshmaki.me. 

ws://localhost:8080   # WebSocket endpoint (quickstart)
04

Trust, not faith.

The build is hermetic and static, so a ReleaseFast build at a fixed commit is bit-for-bit reproducible. You never have to trust a release machine — or us. The published v0.5.6 release is the same byte-identical binary running on both public nodes.

verify from source

packaging/release.sh        # build + SBOM + provenance
packaging/verify-release.sh # rebuild → must match SHA256SUMS

verify-release.sh exits non-zero if the rebuild isn’t byte-identical — a tampered or differently-sourced binary is caught mechanically.

  • SHA256SUMS One integrity manifest over the binary, quickstart, SBOM, and provenance. This first release is unsigned, so verify the hashes and reproducible build.
  • onyx-server.cdx.json A CycloneDX SBOM that fits on one screen, because the dependency graph is a single binary with zero external components.
  • onyx-server.provenance.json An SLSA-provenance-v1 attestation pinning what was built, from which commit, how, and by whom.
Download v0.5.6 Read the source Join the public network Install Onyx app