Jimi Leander
• 7 min read • Production

Stoat Chat (chat.leander.media): Sovereign Real-Time Messaging, OIDC SSO & WebRTC Voice

Self-hosted Stoat v0.15 communication platform featuring a custom Zitadel OIDC PKCE Single Sign-On & Invite Bridge, Nordic WireGuard LiveKit WebRTC voice/video relay, and pre-configured native clients for Windows, Linux, Android, and Web.

#Stoat #WebRTC #LiveKit #Zitadel #OIDC #Rust
GitLab Repository ↗

Overview

Stoat Chat (chat.leander.media) is our sovereign real-time messaging, voice, and screen-sharing platform—built on the open-source Stoat (v0.15) stack, integrated with Zitadel OIDC Single Sign-On (auth.leander.media), and distributed with pre-configured desktop and mobile applications.

CHAT.LEANDER.MEDIA // STOAT REAL-TIME CHAT, OIDC SSO & WEBRTC VOICE VECTOR SVG // v1.0.0-leander 1. IDENTITY & INVITE GATEWAY • auth.leander.media (Zitadel OIDC IdP) • OAuth 2.0 Authorization Code + PKCE • Role-Gated Access (stoat-user / admin) • Time & Use-Limited Invite Links • Zero Separate Chat Password Required 2. STOAT CHAT CORE (chat.leander.media) • Stoat v0.15 API & Bonfire WebSocket • Custom OIDC SSO Auto-Provision Bridge • Autumn Encrypted Attachment Storage • January Privacy-Preserving Media Proxy • Bilingual GDPR & ToS (info.leander.media) 3. NORDIC WEBRTC VOICE & VIDEO • LiveKit SFU Low-Latency Media Engine • Nordic Cloud Edge Relay via WireGuard • Direct UDP/TCP ICE Candidate Routing • Origin Network 100% Shielded • HD Screen Sharing & Voice Channels 4. INSTANT WEB & PRE-CONFIGURED NATIVE CLIENTS • Web App: https://chat.leander.media (One-Click Browser Login) • Windows x64: Setup Installer (.exe) & Single-File Portable (.exe) • Linux x86_64: Debian/Ubuntu (.deb) & Portable (.AppImage) • Android ARM64: Signed Native Release (.apk) 5. OPEN-SOURCE MIRRORS & RELEASES (v1.0.0-leander) • Release Hub: gitlab.leander.media/services/chat/stoat • Pre-Patched Default Server: https://chat.leander.media • Full Source Mirrors: for-desktop, for-android, for-web, stoatchat • Sanitized Self-Hosted Compose & OIDC Bridge Repository
Stoat Chat Architecture — Zitadel OIDC SSO Bridge, LiveKit WebRTC Edge Relay & Client Ecosystem (Vector SVG)

Key Engineering Highlights

1. Custom Zitadel OIDC PKCE Bridge & Invite Manager (/sso & /sso/invites)

  • Implements OAuth 2.0 Authorization Code + PKCE authentication against https://auth.leander.media.
  • Enforces Zitadel project role assertions (stoat-user and stoat-admin) and automatically provisions Stoat user accounts and active browser sessions on login.
  • Provides a built-in Invite Management Portal (/sso/invites) for minting time- and use-limited invite links (https://chat.leander.media/invite/<code>).
  • Supports long-form engineering logs and code snippets natively with a patched 40,000-character message limit across the Rust API and all clients.

2. Nordic WireGuard LiveKit WebRTC Voice & Video Relay

  • Routes LiveKit SFU WebRTC UDP/TCP media streams through a dedicated Nordic cloud edge node over a kernel WireGuard tunnel.
  • Delivers low-latency voice channels and HD screen sharing while keeping the home origin network completely hidden from public ICE candidates.

3. Pre-Configured Multi-Platform Client Deliverables (v1.0.0-leander)

All client repositories are mirrored and built under https://gitlab.leander.media/services/chat with https://chat.leander.media baked in as the default server endpoint: