Jimi Leander
• 11 min read

Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide

How we deployed our self-hosted Stoat Chat platform at chat.leander.media with Zitadel OIDC Single Sign-On, low-latency Nordic LiveKit WebRTC voice/video, and pre-configured native apps for Windows, Linux, Android, and Web.

#Stoat #Chat #WebRTC #Zitadel #SSO #OpenSource #Guide

As part of the Leander.Media Sovereign Cloud Platform, we wanted a fast, modern real-time messaging, voice, and screen-sharing platform for friends and collaborators—without handing our conversations, voice streams, or social graph over to third-party ad-tech platforms.

Today, chat.leander.media is live, powered by Stoat Chat (v0.15), integrated with Zitadel OIDC Single Sign-On (auth.leander.media), backed by a Nordic LiveKit WebRTC voice/video edge relay, and paired with pre-configured desktop and mobile apps hosted on our public GitLab forge.

CHAT.LEANDER.MEDIA // STOAT REAL-TIME CHAT, OIDC SSO & WEBRTC VOICE VECTOR SVG // v1.0.0-leander 1. IDENTITY & INVITE GATEWAY • auth.leander.media (Zitadel OIDC IdP) • OAuth 2.0 Authorization Code + PKCE • Role-Gated Access (stoat-user / admin) • Time & Use-Limited Invite Links • Zero Separate Chat Password Required 2. STOAT CHAT CORE (chat.leander.media) • Stoat v0.15 API & Bonfire WebSocket • Custom OIDC SSO Auto-Provision Bridge • Autumn Encrypted Attachment Storage • January Privacy-Preserving Media Proxy • Bilingual GDPR & ToS (info.leander.media) 3. NORDIC WEBRTC VOICE & VIDEO • LiveKit SFU Low-Latency Media Engine • Nordic Cloud Edge Relay via WireGuard • Direct UDP/TCP ICE Candidate Routing • Origin Network 100% Shielded • HD Screen Sharing & Voice Channels 4. INSTANT WEB & PRE-CONFIGURED NATIVE CLIENTS • Web App: https://chat.leander.media (One-Click Browser Login) • Windows x64: Setup Installer (.exe) & Single-File Portable (.exe) • Linux x86_64: Debian/Ubuntu (.deb) & Portable (.AppImage) • Android ARM64: Signed Native Release (.apk) 5. OPEN-SOURCE MIRRORS & RELEASES (v1.0.0-leander) • Release Hub: gitlab.leander.media/services/chat/stoat • Pre-Patched Default Server: https://chat.leander.media • Full Source Mirrors: for-desktop, for-android, for-web, stoatchat • Sanitized Self-Hosted Compose & OIDC Bridge Repository
Stoat Chat (chat.leander.media) — OIDC Single Sign-On, LiveKit WebRTC Relay & Native Client Ecosystem (Vector SVG)
1. Click Invite or Visitchat.leander.media
2. Authenticate via Zitadel SSO(auth.leander.media)
3. Auto-Provisioned Session(stoat-user / stoat-admin)
4. Chat, Voice & Screen Share(Web, Windows, Linux, Android)

1. How to Get Started (chat.leander.media)

Joining takes less than a minute and works immediately in your browser, on your desktop, or on your phone.

Access to chat.leander.media is invite-only and protected by Leander.Media Single Sign-On (Zitadel):

  1. If you received an Invite Link (https://chat.leander.media/invite/<code> or /sso/register/<code>):
    • Click the invite link in your browser.
    • It automatically validates your invite token and redirects you to https://auth.leander.media to log in or complete your account setup.
    • Once authenticated, our OIDC bridge automatically grants your account access, provisions your Stoat profile, and logs you straight into the chat!
  2. If you already have a leander.media SSO account:

Step 2: Download the Pre-Configured Desktop & Mobile Apps (v1.0.0-leander)

While the Web App (https://chat.leander.media) works out of the box in any browser, we also maintain and build native desktop and mobile clients pre-configured to connect directly to https://chat.leander.media by default—no manual custom server URL typing required.

All runnable single-file binaries and full source code are available on our public GitLab release page:

PlatformPackage TypeDirect Download LinkNotes
Windows (x64)Setup Installer (.exe)Stoat-Desktop-Windows-Setup.exeStandard Windows desktop installer with tray & notifications.
Windows (x64)Portable Binary (.exe)Stoat-Desktop-Windows-Portable.exeSingle-file executable — run from anywhere with zero install.
Linux (x86_64)Debian / Ubuntu (.deb)Stoat-Desktop-Linux-amd64.debInstall via sudo apt install ./Stoat-Desktop-Linux-amd64.deb.
Linux (x86_64)Portable (.AppImage)Stoat-Desktop-Linux-x86_64.AppImagechmod +x Stoat-Desktop-Linux-x86_64.AppImage && ./Stoat-Desktop-Linux-x86_64.AppImage.
Android (ARM64)Signed Release (.apk)Stoat-Android-arm64-v8a-release.apkNative Kotlin/Compose Android app pre-pointed at chat.leander.media.
Web BundleSelf-Hosted Static (.zip)Stoat-Web-SelfHosted-Dist.zipPre-built static web bundle for offline auditing or local hosting.

2. Under the Hood: Architecture & Privacy

A. Zitadel OIDC Bridge & Invite Portal

Upstream Stoat/Revolt uses standalone email/password authentication via Shield. To unify identity across leander.media without forking the core Rust database schema, we built a lightweight OIDC PKCE Bridge (sso-bridge) sitting alongside the API behind Caddy:

  • Validates OAuth 2.0 Authorization Code + PKCE flows against https://auth.leander.media.
  • Enforces Zitadel role assertions (stoat-user and stoat-admin) before provisioning or issuing sessions.
  • Includes a built-in Admin Invite Portal (/sso/invites) allowing stoat-admin members to generate single-use or time-limited onboarding links on the fly.

B. Low-Latency Nordic LiveKit WebRTC Voice & Video

WebRTC voice and screen sharing require direct UDP/TCP media streams (LiveKit SFU), which cannot pass through standard HTTP-only reverse proxies without adding latency:

  • Voice and video traffic routes through a dedicated Nordic cloud relay over a kernel WireGuard tunnel.
  • Clients establish WebRTC media streams with sub-15ms regional latency while the underlying homelab origin IP remains 100% shielded.

C. Open Source & Transparency

In keeping with our open-source licensing commitments, every line of client and deployment code is published under https://gitlab.leander.media/services/chat:

For full details on data handling, GDPR privacy rights, and open-source licenses, visit https://info.leander.media.