- stop counting ACK and Pong frames toward the per-connection frame window;
draining a large queue used to trip the 429 limit, disconnect the client
and, after eight rounds, drop the remaining envelopes
- deliver to online recipients with try_send: a recipient that stops reading
its socket no longer pins the sender's task and memory
- throttle call wake-ups per recipient (1 per 10 s, 6 per 10 min) and
ordinary wake-ups (1 per 5 s); collapse ids for APNs and FCM
- POST /v1/register accepts X-Sepot-Identity-Proof and lets a new device take
over an existing identity (restore from the recovery phrase)
- POST /v1/keys uploads one-time prekeys and rotates signed/Kyber prekeys;
PrekeysLow is sent after AUTH when fewer than 20 remain
- GET /v1/keys hands out at most 30 one-time prekeys per address per hour
- reqwest errors are logged without the URL; UnifiedPush POSTs pin the
addresses the SSRF guard resolved; NAT64/6to4 embedded addresses are checked
- absolute AUTH deadline, at most 3 AUTH attempts, length limits on push
endpoints and VoIP tokens
- TURN credentials live 12 h and are reissued per connection every 10 min
- global attachment storage cap (SEPOT_ATTACHMENTS_TOTAL_BYTES), nosniff and
attachment disposition on downloads
- SEPOT_MAX_CONNS_PER_IP, /v1/ready backed by the database, graceful shutdown,
RLIMIT_NOFILE raised to the hard limit, server-info reports source and revision
- Dockerfile: rust 1.99, GIT_SHA build arg for the image label and
SEPOT_REVISION; Tor image on alpine 3.24
Protocol and relay groundwork for typing indicators and 1:1 calls.
- ContentHint.EPHEMERAL: delivered only to an online recipient, never
queued or pushed; the sender gets Receipt.STATUS_DROPPED otherwise.
- ContentHint.CALL: a call offer is queued like a normal message, but an
offline recipient is woken immediately — a PushKit VoIP push on iOS
(priority 10, 45 s expiry) or a short-lived FCM data message on
Android. The relay learns that a device is being called, not by whom.
- RegisterPush.voip_token stores the iOS VoIP token next to the regular
APNs token (migration 0004).
- TurnRequest/TurnCredentials: logged-in devices receive time-limited
coturn credentials (use-auth-secret REST scheme, HMAC-SHA1), so the
TURN server is never an open relay. Configured with SEPOT_TURN_URLS and
SEPOT_TURN_SECRET or SEPOT_TURN_SECRET_FILE; without them calls fall
back to direct connections and STUN.
The APNs wake-up was sent with apns-expiration 0, so a phone without
connectivity at that moment (tunnel, flight) never received it and did
not learn about the message until someone opened the app. APNs now keeps
the wake-up for as long as the envelope stays in the relay queue.
Priority stays at 5: APNs rejects priority 10 for background pushes.
Immediate delivery on iOS needs a visible alert push handled by a
Notification Service Extension, which is an app change.
axum does not set TCP_NODELAY. Right after AUTH the relay writes
AUTH_OK and immediately the first queued DELIVER; with Nagle enabled the
second write waited for the peer's delayed ACK, adding about 40 ms to
the path a woken-up app takes to fetch its messages.
After a network change (Wi-Fi to mobile data) the app reconnects right
away, while the relay only notices the old connection is dead once the
idle timeout expires. When that stale handler finally exited it removed
the device from the online map by address alone, which dropped the new,
healthy connection. From then on every message was stored as offline and
only a push wake-up could fetch it, even though the app was connected.
The online map is now its own type: a newly authenticated connection
takes over delivery for the address, and a closing connection removes
the entry only if it still points at itself. Tests cover the registry
and the full route after a stale connection ends.
Messages arrived late or not at all, for two independent reasons.
Dead connections: neither side sent a ping, and after AUTH the server
waited for a frame without a timeout. Mobile NAT drops idle TCP silently,
so the client wrote into a void while the relay still held the device in
its online map — and therefore never sent a push wake-up either. The ping
is a protocol-level one rather than v1::Ping, because dart:io answers
those on its own; the fix works with clients already in the wild.
Poisoned queue: a client decrypts an envelope (ratchet advances), stores
it and acknowledges it. If that ACK is lost, a second decryption attempt
can only fail, so the envelope is never acknowledged — and was redelivered
on every connect until its 30-day TTL, without ever reaching the recipient.
attempt_count existed from the first migration but was never counted; it
now bounds redelivery.
Receipts reported DELIVERED_ONLINE whenever a write into the bounded mpsc
channel succeeded, which it does even for a long-dead socket. Online is now
claimed only for devices that recently sent something.
Push send failures were logged at debug while the relay runs at info, so a
rejected wake-up looked exactly like a working one.
Rate limiting and the per-IP WebSocket cap trusted X-Forwarded-For and
X-Real-Ip unconditionally. Onion traffic bypasses the reverse proxy, so a
client could set the header itself and slip past every limit. Forwarded
headers are now honoured only from peers inside SEPOT_TRUSTED_PROXIES;
everyone else is keyed by peer address, and onion clients share one bucket.
The queue flush also read the whole backlog into memory at once, and the
certificate authority kept the trust-root private key in the database even
though it is only ever needed offline.
Initial public release. Anonymous on-device identity (no phone number,
e-mail, or password), Signal-protocol cryptography (X3DH + PQXDH, Double
Ratchet, sealed sender) via libsignal, a metadata-minimizing relay,
group chats, disappearing messages, encrypted local storage, optional
Tor transport, and a UI localized into Czech, English, German, Russian,
and Italian.
Monorepo: Flutter client (app/), Rust relay + wire types (rust/),
protobuf definitions (proto/), self-host deploy (deploy/).
Licensed under AGPL-3.0 with an app-store distribution exception (§7).
Julius Joska