Host your own community

Every place you visit in Satchel is kept by a host that someone runs, and you can run your own. This page is the short version. The full steps are in the host guide in the satchel-host repository.

What a Satchel host adds

Session Router lets anyone serve an ordinary website at a .sesh address, and Satchel adds these on top:

• Sealed mail. Your Satchel signs each message and then seals it to the recipient's key before it leaves your device. Only the recipient can open it. The mail host sees who the message is for, a message id, its padded size and when it arrived. It never sees the sender, the subject or the text. It deletes the message once the recipient's Satchel has saved it, or, if it's never picked up, after 7 days by default (up to 30 if the sender asks).
• Encrypted files. Satchel encrypts a file on your device before it uploads, with a new key for each file. The host stores only the scrambled bytes, padded to a size step, so it can't read the file or its name and learns only a rough size. You choose who can open it: anyone with the link, or only the people you give access to. The host can't see what the file is, and it sees only the key that uploaded it, not who you are.
• No accounts on the host. People post with their own key. There is no sign-up and no password kept on the host. A small proof-of-work puzzle and rate limits hold back spam.
• Signed records. Each record (a chat message, a forum post, a wiki edit and so on) is signed by the key that posted it, and Satchel checks every signature before showing anything. A host can delete posts, but it can't forge them or edit them.
• One identity across communities. People can create profiles (name, short bio, picture) tied to their key. A profile can be the same everywhere or specific to one place, such as one profile for all of a host's apps.

What a host can serve

A host keeps the data for a community and serves it as a .sesh place over Session Router. You pick one type when you set it up. Each type holds its own kinds of signed records:

Apps and communities may use these records in their own ways. Every type except mail and board also takes profile records.

One host can serve several places at once. A rooms host can carry many rooms, and any type except mail and board can also carry an app collection. Each place gets its own signed delegation and its own invite link. A host can't add new kinds of records; new features come as apps.

Your server, your keys, your rules

A host runs on a computer or server that you run. Nobody else holds the keys, and you decide the rules.

• The root key is the identity of your community. It stays on a second machine, ideally one that is offline, like an old laptop or a live USB. Its public half, the root pin, travels in every invite link, and Satchel remembers it the first time someone joins.
• The host key lives on the server and signs the day-to-day data. The root key vouches for it for up to 90 days at a time, so you renew it every 90 days or sooner.
• Out of the box the host listens only on 127.0.0.1. People reach it through a separate Session Router instance for the host's own .sesh name.

You are responsible for what you host under your local laws.

Getting started

The host tools are made for a Linux server. On Windows, run them inside WSL. This only affects running a host: people join your community with Satchel as usual.

You need Python 3.10 or newer with the cryptography package (sudo apt install python3 python3-cryptography on Debian or Ubuntu), a second machine for the root key, and about 10 minutes. With systemd, the tool installs a locked-down service. Without it, satchel-host run runs the host in a terminal. To try it out without root, add --prefix with a folder in your home directory.

1. Get the tools. Download or clone the satchel-host repository.
2. Make the root key on the offline machine, once. Write down the root pin it prints and back up the key file.

   ./bin/satchel-host root init --dir ./satchel-root

3. Create the place on the server. Pick a type and a name. --sesh new gives the host its own .sesh name.

   sudo ./bin/satchel-host init --type rooms --name lobby --room hikers --sesh new

   This writes a file called request.json.
4. Sign it on the offline machine. Check that the host key it shows matches the one the server printed.

   ./bin/satchel-host root sign request.json --days 90

5. Install it on the server. With systemd this starts the host as a service. Without it, start the host with satchel-host run --prefix …. Either way it prints your invite links.

   sudo ./bin/satchel-host install-delegation delegation.json \
       --prefix /opt/satchel-host/lobby

6. Open it up. Start a separate Session Router instance for the host's .sesh name. The exact steps are in sesh/ENABLE.txt inside the host's folder.
7. Share the join link. This prints the links, ready to share:

   ./bin/satchel-host link --prefix /opt/satchel-host/lobby

   Each link carries everything Satchel needs: the host's .sesh address, the place and your root pin.

   srnet://<address>.sesh/room/hikers#root=<root pin>

satchel-host status shows the host's health and how many days are left before you need to renew. The guide also covers renewing, upgrading, backups, mail hosts, file limits and listing your community in a directory.

Moderation

Every moderation action is a signed, public record, so people can see what you did.

• Hide a post for spam or off-topic. It stays on the host, and Satchel hides it by default; people can choose to show it. You can also hide everything from one key, and unhide later.
• Remove content you must not keep. The host removes the post from its database right away (and the file, for a file post), and Satchel and mirrors drop their copies when they next sync. A small signed placeholder stays so the room's history still checks out. A remove can't be undone, and it can't take back copies someone already saved.
• Pin up to 3 posts at the top of a room or board.
• Set the header: the description and rules shown at the top of a room.

satchel-host moderate --prefix … hide post <id> --reason spam
satchel-host moderate --prefix … pin post <id>
satchel-host header --prefix … --description "…" --rules "…"

People can also delete their own posts, and room and board posts are removed automatically after 180 days. Wiki pages and apps are kept.

Your own apps

An app is one JavaScript file. Satchel runs it in a sandbox, so it has no network, no access to the web page and no keys. It can read the place it's opened in, draw a small panel and suggest posts. Satchel shows the person exactly what will be signed, and nothing is posted unless they say yes. Satchel also asks before it runs an app the first time, and again whenever its code changes.

You publish an app with your root key. An app can be its own place, or the view for a room, wiki, directory or profile list. Up to 8 apps can be offered in one place.

• Write your first app: a guestbook, from the starter file to running in Satchel.
• App guide: everything an app can call, the panel format and the limits.
• 13 example apps: a chat room, a forum, a wiki, polls, a file list, profiles and more, plus a test app that tries to break out of the sandbox.

The code

The host tools, the guides, the starter app and the example apps are in the satchel-host repository. Copyright the Satchel authors, under the Mozilla Public License 2.0.