self-host
The same daemon that runs Onyx is a single static binary with zero external dependencies — no database to babysit, no OpenSSL to patch, no runtime to install. Point it at the quickstart config and you have a sovereign node in about a minute. Keep it standalone, or link it into our mesh — it’s AGPL, top to bottom.
Native is the true 60-second path — one binary, one config. Docker is a build‑then‑run away. There’s no registry image to pull yet; you build orochi:latest locally from source.
Path one · native
Build it from source (below) or drop in a release binary, then hand it the zero-config quickstart. That’s the whole ceremony.
./orochi packaging/orochi.quickstart.tomlBoots plaintext ws://localhost:8080 + irc://localhost:6667 for local evaluation.
Path two · docker
Build the reproducible artifact first, then the image is just that binary plus the quickstart config on Alpine.
packaging/release.sh # verified static binary → dist/
docker build -f packaging/Dockerfile -t orochi:latest .
docker run -p 6667:6667 -p 8080:8080 \
-v orochi:/data orochi:latestThe named orochi:/data volume persists your node key + account store across restarts.
Both paths above are plaintext, for local evaluation. For production, swap the quickstart for a TLS config — real certs or the built-in ACME client — set ws_plain = false, and a real server_name.
Everything a node needs is inside the one binary. The software bill of materials is, effectively, one line.
A from-scratch, no-C-interop TLS stack — no OpenSSL to install, track CVEs on, or patch at 2 a.m.
One serpent, many heads: nodes federate over an encrypted, post-quantum-hybrid link. Stand alone, or join ours — no permission asked.
Accounts, channel registration, cloaked hosts, passkeys — real server commands, not bolted-on pseudo-clients or a second process.
No database server, no runtime, no dependency tree. The node’s identity key and account store are plain files in the working directory (/data in the image).
| Endpoint | For |
|---|---|
| ws://…:8080 | The Onyx web client, in any browser |
| irc://…:6667 | Any standard IRC client, including thirty-year-old ones |
Two front doors into the exact same node — the first-party browser client, or any IRC client you already trust.
Browser
Onyx picks its server at build time. Set VITE_IRC_WS, build, and serve the static dist/ anywhere — or use a hosted Onyx build.
VITE_IRC_WS=ws://localhost:8080 pnpm buildIRC
Any standard IRC client works — point it at localhost:6667 for the plaintext quickstart, or your TLS port in production. Same rooms, same network.
/server localhost 6667The build is hermetic and static, so a ReleaseFast build at a fixed commit is bit-for-bit reproducible. You never have to trust the release machine — or us.
verify from source
packaging/release.sh # build + SBOM + provenance
packaging/verify-release.sh # rebuild → must match SHA256SUMSverify-release.sh exits non-zero if the rebuild isn’t byte-identical — a tampered or differently-sourced binary is caught mechanically.