- JavaScript 72.3%
- Shell 18.4%
- CSS 7.3%
- HTML 2%
Enclave
Self-hosted, Sigil-native chat substrate for trust-network-scale groups (1-1000 users). First-class identities for humans AND bots (personal automation, AI agents, integrations) — no second-class "bot account" model. Built on IRCv3, planned to grow into a Sigil-native embedded DB, HTTP/2 PWA, and WASM client over subsequent phases.
This repo is a multi-package Sigil workspace; packages/enclave-server
is the IRCv3 server. The strategic frame is a communication substrate
for personal infrastructure, families, and small communities.
Highlights
- IRCv3 server — connectable, multi-user, SASL PLAIN authenticated, with persistent history in an embedded sqlite store.
- First-class bot identities — humans and bots are the same kind of account. Bots carry owner attribution, per-owner quotas, and an explicit allowed-channel scope. See Bots and groups.
- Access groups + channel ACLs — channels register to an owner
and attach permission groups (
op/voice/normal/read-only), with voice-only (+m) channels for feeds. - EnclaveServ in-IRC admin bot — one command catalog drives both
the
enclaveCLI and/msg EnclaveServ, with machine-parseable+enclave/result.*message tags. - Moderation + privacy — reports, kicks / bans / mutes, retained-body investigation with an audit trail, GDPR-style erasure, and a strict logging privacy contract (message bodies and tokens are never logged).
- Operator tooling — retention / quota policy, maintenance announcements, a soju-compatible filehost, and read markers.
- Narrow TLS surface — the daemon speaks plain TCP; TLS termination lives in stunnel (Linux) / relayd (OpenBSD) in front of it, so operators reuse the certbot / acme-client toolchain they already run.
Quick Start
A fresh clone to a connected client takes about five minutes.
# 1. Build the daemon (one-time).
sigil deps install --redirects ./dev-redirects.sgl
sigil build enclave-server --redirects ./dev-redirects.sgl
# 2. Bootstrap a config + admin user.
./build/dev/bin/enclave init
# walks you through server-name, admin nick + password, paths,
# and TLS choice. Writes ./config.sgl + initializes ./enclave.db.
# 3. Run.
./build/dev/bin/enclave serve
Connect from any IRCv3 client — Senpai, Catgirl, irssi, weechat,
Goguma — at irc://localhost:6667 with SASL PLAIN using the admin
credentials you just chose. See Connecting for
client-specific configs. If 6667 is in use, override with
ENCLAVE_PORT=16667.
For local iteration with no setup at all, ./build/dev/bin/enclave dev
spins up plain TCP on 6667 against a tempdir sqlite and seeds three
admin users (admin/admin, david/david, agent/agent) so you can
connect two clients and chat with yourself. A loud DEV-MODE warning
prints in the logs; the tempdir store evaporates on restart.
Documentation
| Doc | What's in it |
|---|---|
| CLI reference | Every subcommand: server modes, admin verbs, bot / group / channel / user / maintenance management, and non-interactive enclave init flags. |
| Configuration | config.sgl format and sections, trust tiers + bot policies, environment overrides, and the logging + privacy contract. |
| Bots and groups | Bot identity walk-through, access groups + channel ACLs, the EnclaveServ bot, bot access to EnclaveServ (leader/worker pattern), and bot rate limiting. |
| Moderation | Investigation commands, /REPORT handling, kick / ban / mute actions, and message deletion. |
| Filehost | The soju-compatible upload endpoint: config, upload / retrieval protocol, quotas, retention, and admin removal. |
| Features | Read markers, the PWA conversation list, and maintenance announcements. |
| Deployment | Production deploy shape, systemd + OpenBSD rc.d units, TLS via stunnel / relayd, cert paths, and retention + quotas. |
| Connecting | Client configs for Senpai, Catgirl, irssi, weechat, and Goguma, plus self-signed TOFU pinning. |
| Troubleshooting | Common startup, auth, bot, and TLS symptoms with fixes, plus the test suites. |
License
BSD-3-Clause. See package metadata at
packages/enclave-server/package.sgl.