Platform</th>	Package Type</th>	Direct Download Link</th>	Notes</th></tr></thead>
Windows (x64)</strong></td>	Setup Installer (`.exe</code>)</td>`	Stoat-Desktop-Windows-Setup.exe</a></td>	Standard Windows desktop installer with tray & notifications.</td></tr>
Windows (x64)</strong></td>	Portable Binary (`.exe</code>)</td>`	Stoat-Desktop-Windows-Portable.exe</a></td>	Single-file executable — run from anywhere with zero install.</td></tr>
Linux (x86_64)</strong></td>	Debian / Ubuntu (`.deb</code>)</td>`	Stoat-Desktop-Linux-amd64.deb</a></td>	Install via `sudo apt install ./Stoat-Desktop-Linux-amd64.deb</code>.</td></tr>`
Linux (x86_64)</strong></td>	Portable (`.AppImage</code>)</td>`	Stoat-Desktop-Linux-x86_64.AppImage</a></td>	`chmod +x Stoat-Desktop-Linux-x86_64.AppImage && ./Stoat-Desktop-Linux-x86_64.AppImage</code>.</td></tr>`
Android (ARM64)</strong></td>	Signed Release (`.apk</code>)</td>`	Stoat-Android-arm64-v8a-release.apk</a></td>	Native Kotlin/Compose Android app pre-pointed at `chat.leander.media</code>.</td></tr>`
Web Bundle</strong></td>	Self-Hosted Static (`.zip</code>)</td>`	Stoat-Web-SelfHosted-Dist.zip</a></td>	Pre-built static web bundle for offline auditing or local hosting.</td></tr> </tbody></table> 2. Under the Hood: Architecture & Privacy</h2> A. Zitadel OIDC Bridge & Invite Portal</h3> Upstream Stoat/Revolt uses standalone email/password authentication via Shield. To unify identity across `leander.media</code> without forking the core Rust database schema, we built a lightweight OIDC PKCE Bridge (sso-bridge</code>)</strong> sitting alongside the API behind Caddy:</p>` Validates OAuth 2.0 Authorization Code + PKCE</strong> flows against https://auth.leander.media</code>.</li> Enforces Zitadel role assertions (stoat-user</code> and stoat-admin</code>) before provisioning or issuing sessions.</li> Includes a built-in Admin Invite Portal (/sso/invites</code>)</strong> allowing stoat-admin</code> members to generate single-use or time-limited onboarding links on the fly.</li> </ul> B. Low-Latency Nordic LiveKit WebRTC Voice & Video</h3> WebRTC voice and screen sharing require direct UDP/TCP media streams (LiveKit SFU</code>), which cannot pass through standard HTTP-only reverse proxies without adding latency:</p> Voice and video traffic routes through a dedicated Nordic cloud relay over a kernel WireGuard tunnel</strong>.</li> Clients establish WebRTC media streams with sub-15ms regional latency while the underlying homelab origin IP remains 100% shielded.</li> </ul> C. Open Source & Transparency</h3> In keeping with our open-source licensing commitments, every line of client and deployment code is published under https://gitlab.leander.media/services/chat</code></strong>:</p> services/chat/stoat</code></a></strong> — Master hub & release deliverables (v1.0.0-leander</code>)</li> services/chat/for-desktop</code></a></strong> — Electron desktop client source</li> services/chat/for-android</code></a></strong> — Android native client source</li> services/chat/for-web</code></a></strong> — SolidJS web client source</li> services/chat/stoatchat</code></a></strong> — Rust backend services (Delta API, Bonfire WebSocket, Autumn, January)</li> services/chat/self-hosted</code></a></strong> — Sanitized Docker Compose stack & Zitadel OIDC bridge</li> </ul> For full details on data handling, GDPR privacy rights, and open-source licenses, visit https://info.leander.media</code></a></strong>.</p> Project Smörgåsbord: Two-Tier Sovereign Cloud & Zero-Trust Mesh Unknown — Sat, 24 Oct 2026 00:00:00 +0000 Overview</h2> Project Smörgåsbord</strong> is the sovereign, self-hosted infrastructure platform powering leander.media</code>—combining local Proxmox virtualization and high-capacity storage with stateless Cloudflare Zero Trust tunnels and a Nordic WireGuard edge relay.</p> Design Philosophy</div> Keep stateful data, Git repositories, Syncthing vaults, mail storage, and high-compute workloads on local hardware you physically control, while using stateless encrypted tunnels and cloud edge relays for zero-trust public ingress, WebRTC media routing, and high-deliverability mail transport.</p> </div></aside> Key Subsystems</h2> 1. Split-Horizon WireGuard Edge & Zero-Trust Ingress</h3> HTTP/HTTPS workloads are isolated per stack behind dedicated Cloudflare Zero Trust Tunnels</strong> (leander.media</code>, blog.leander.media</code>, chat.leander.media</code>, info.leander.media</code>, mail.leander.media</code>, biohacking.leander.media</code>, djtools.leander.media</code>, gitlab.leander.media</code>, registry.leander.media</code>).</li> Latency-sensitive UDP WebRTC voice/video streams (chat.leander.media</code>, turn.leander.media</code>), Matrix S2S federation (matrix.leander.media</code>), Git SSH (ssh.gitlab.leander.media</code>), dedicated game servers (mc</code>, swamp</code>, ftb</code>, vh.leander.media</code>), and inbound/outbound SMTP/IMAPS mail connections traverse dedicated kernel WireGuard tunnels</strong> to Nordic cloud edge relays in Helsinki (hel1.leander.media</code>) and Stockholm (mx.leander.media</code>), keeping the home origin network completely unexposed (0</code> residential WAN IP records in public DNS).</li> </ul> 2. Self-Hosted GitLab CE 19.5 (gitlab.leander.media</code>, ssh.gitlab.leander.media</code> & registry.leander.media</code>)</h3> Self-hosted GitLab Community Edition 19.5</strong> and GitLab Container Registry (registry.leander.media</code>)</strong> hosting public open-source mirrors/releases, OCI container images, and private engineering repositories behind a dedicated Cloudflare HTTP/2 Tunnel and a 2 ms Helsinki WireGuard SSH relay (ssh.gitlab.leander.media</code>).</li> Powers automated CI/CD verification for hardware EDA designs, container builds, and versioned backups of our Obsidian knowledge base.</li> </ul> 3. Sovereign Mail (mail.leander.media</code>) & DMARC Security Pipeline</h3> Stalwart Mail Server + SnappyMail Webmail</strong> configured with dual RSA-2048 & Ed25519 DKIM signing, strict SPF, and DMARC enforcement, paired with an authenticated European outbound TLS relay.</li> Custom DMARC Prometheus Exporter</strong> parses aggregate XML/ZIP reports in real time and feeds VictoriaMetrics</strong> and Grafana</strong> security dashboards.</li> </ul> 4. Zitadel OIDC Identity (auth.leander.media</code>) & Bilingual Info Hub (info.leander.media</code>)</h3> Centralized Zitadel OIDC</strong> identity provider supporting Passkeys/WebAuthn and OAuth 2.0 PKCE across internal and external portals.</li> Standalone bilingual (FI</code> / EN</code>) compliance portal at info.leander.media</code></a></strong> (public source repo</a>) serving GDPR privacy documentation, Terms of Service, EULA, and open-source attributions.</li> </ul> 5. Zero-JS Obsidian-to-Zola Publishing Engine</h3> Real-time Syncthing</strong> replication from desktop and mobile Obsidian vaults directly to our build pipeline.</li> Automated exiftool</code> + Pillow preprocessor strips EXIF/GPS metadata from camera photos, converts Obsidian callouts and wikilinks, and triggers sub-50ms Zola</strong> static builds with 0 KB</code> of client-side JavaScript.</li> </ul> # Compile-time syntax highlighting & zero client-side JavaScript </span>base_url </span>= </span>"https://blog.leander.media" </span>compile_sass </span>= </span>false </span>generate_feeds </span>= </span>true </span>feed_filenames </span>= [</span>"atom.xml"</span>, </span>"rss.xml"</span>] </span> </span>[</span>markdown</span>] </span>highlight_code </span>= </span>true </span>highlight_theme </span>= </span>"ayu-dark" </span></code></pre> Related Writeups</h2> Read the architecture deep dive: Designing a Two-Tier Sovereign Cloud, Mail & Zero-JS Publishing Platform</a></strong></li> Join the chat platform: Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide</a></strong></li> Explore the hardware CI/CD stack: Automated Hardware & KiCad EDA Verification Pipeline</a></strong></li> </ul> Stoat Chat (chat.leander.media): Sovereign Real-Time Messaging, OIDC SSO & WebRTC Voice Unknown — Sat, 24 Oct 2026 00:00:00 +0000 Overview</h2> Stoat Chat (chat.leander.media</code>)</a></strong> is our sovereign real-time messaging, voice, and screen-sharing platform—built on the open-source Stoat (v0.15</code>) stack, integrated with Zitadel OIDC Single Sign-On (auth.leander.media</code>)</strong>, and distributed with pre-configured desktop and mobile applications.</p> Key Engineering Highlights</h2> 1. Custom Zitadel OIDC PKCE Bridge & Invite Manager (/sso</code> & /sso/invites</code>)</h3> Implements OAuth 2.0 Authorization Code + PKCE</strong> authentication against https://auth.leander.media</code>.</li> Enforces Zitadel project role assertions (stoat-user</code> and stoat-admin</code>) and automatically provisions Stoat user accounts and active browser sessions on login.</li> Provides a built-in Invite Management Portal (/sso/invites</code>)</strong> for minting time- and use-limited invite links (https://chat.leander.media/invite/<code></code>).</li> Supports long-form engineering logs and code snippets natively with a patched 40,000-character message limit</strong> across the Rust API and all clients.</li> </ul> 2. Nordic WireGuard LiveKit WebRTC Voice & Video Relay</h3> Routes LiveKit SFU</strong> WebRTC UDP/TCP media streams through a dedicated Nordic cloud edge node over a kernel WireGuard tunnel.</li> Delivers low-latency voice channels and HD screen sharing while keeping the home origin network completely hidden from public ICE candidates.</li> </ul> 3. Pre-Configured Multi-Platform Client Deliverables (v1.0.0-leander</code>)</h3> All client repositories are mirrored and built under https://gitlab.leander.media/services/chat</code></a></strong> with https://chat.leander.media</code> baked in as the default server endpoint:</p> Release Downloads:</strong> v1.0.0-leander</code> Release Page</a></strong> (Windows .exe</code> Installer & Portable, Linux .deb</code> & .AppImage</code>, Android signed .apk</code>, and Web .zip</code>).</li> Getting Started Guide:</strong> Read Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide</a></strong>.</li> </ul> Automated Hardware & KiCad EDA Verification Pipeline Unknown — Tue, 20 Oct 2026 00:00:00 +0000 Overview</h2> Designing custom electronics—from 16kW electric mountainboard power distribution spines (14S4P)</strong> to modular mini line-array DSP amplifiers</strong>—traditionally suffers from manual ERC/DRC checks, fragmented CAD files, and slow design-for-manufacturing (DFM) feedback loops.</p> The Automated Hardware & KiCad EDA Verification Pipeline</strong> brings modern software CI/CD rigor to physical hardware engineering.</p> Deterministic Hardware Revisions</div> Every schematic, PCB layout, and 3D enclosure iteration is tracked in a Git timeline with automated Design Rule Checks (DRC), interactive 3D STEP/GLB model diffing, and one-click owner approval gates before fabrication files (Gerbers, BOM, PnP, 3MF) are emitted.</p> </div></aside> Architecture & Capabilities</h2> 1. Programmatic KiCad ERC/DRC & Fab Artifact Generation</h3> Headless verification runners execute electrical and physical rule checks on every commit.</li> Automated generation of fabrication-ready Gerber archives, interactive HTML BOMs, and pick-and-place centroids.</li> </ul> 2. Merged 3D CAD Workbench & Git Timeline Viewer</h3> Unified browser workbench featuring an interactive 3D model viewer alongside revision history timelines.</li> Supports rapid mechanical iteration with pre-configured Creality</strong> slicing presets for functional enclosure prototyping before committing to CNC aluminum or injection molding.</li> </ul> # Example: Headless pipeline stage contract for hardware revision verification </span>pipeline_stages </span>= </span>[ </span> </span>"spec_guided_synthesis"</span>, </span> </span>"kicad_erc_drc_verify"</span>, </span> </span>"cad_3d_mesh_export"</span>, </span> </span>"creality_slice_validation"</span>, </span> </span>"owner_approval_gate"</span>, </span>] </span></code></pre> 3. Hardware Projects Built with the Pipeline</h3> 16kW Esk8 Mountainboard Power System:</strong> 14S4P high-discharge copper-spine battery pack engineering and VESC telemetry integration.</li> Modular Mini Line Array PoC:</strong> Compact acoustic array enclosures paired with multi-channel Class-D amplification and DSP crossover networks (see RekordRescue & Real-Time Audio/DSP Tooling</a></strong>).</li> </ul> RekordRescue & Real-Time Audio/DSP Tooling Unknown — Sun, 18 Oct 2026 00:00:00 +0000 Overview</h2> Spanning studio production in REAPER</strong>, live hard-dance / electronic DJ performance, and our browser-based DJTools Audio Studio (djtools.leander.media</code>)</a></strong>, RekordRescue & Real-Time Audio/DSP Tooling</strong> is a suite of custom audio tools built for reliability, surgical low-end control, stem separation, and automated library management.</p> Zero-Latency Live & Studio Workflows</div> By combining sample-accurate JSFX</strong> DSP scripts inside REAPER with Python-based library and stem automation, complex bass synthesis and stem separation tasks run deterministically on local hardware.</p> </div></aside> Core Tools & Modules</h2> 1. Custom JSFX Sub-Bass & Reverse-Bass DSP Engine</h3> Real-time REAPER JSFX</strong> synthesis and dynamics processors tailored for reverse-bass tail sculpting, phase-coherent sub-bass reinforcement, and transient shaping.</li> Live hot-patching and parameter telemetry integration via REAPER’s HTTP/OSC control surface APIs.</li> </ul> // JSFX sample-accurate one-pole envelope follower & soft-clipping saturator </span>@sample </span>env </span>= </span>max</span>(</span>abs</span>(spl0)</span>,</span> env </span></span> release_coeff)</span>; </span>drive_spl0 </span>=</span> spl0 </span></span> pre_gain</span>; </span>spl0 </span>=</span> drive_spl0 </span>/ </span>(</span>1</span>.</span>0 </span>+ </span>abs</span>(drive_spl0))</span>; </span>spl1 </span>=</span> spl0</span>; </span></code></pre> 2. Automated REAPER Stem Extractor</h3> High-throughput stem separation pipeline integrating neural source separation models directly into REAPER project timelines.</li> Automatically splits full masters into isolated vocal, drum, bass, and synth stems with phase-aligned routing and tempo-synced markers for remixing and live DJ sets.</li> </ul> 3. RekordRescue Library & Setlist Tooling</h3> Python utilities for inspecting, repairing, and migrating DJ metadata, cue points, beatgrids, and relocated audio files across storage volumes without losing performance preparation work.</li> Connects with our broader homelab storage infrastructure (Project Smörgåsbord</a></strong>) so studio renders and DJ libraries stay backed up via Syncthing.</li> </ul>

Jimi Leander — Hardware, Audio/DSP & Sovereign Infrastructure

Designing a Two-Tier Sovereign Cloud, Mail & Zero-JS Publishing Platform

Unknown — Sat, 24 Oct 2026 00:00:00 +0000

Modern self-hosted infrastructure often falls into one of two traps: either exposing heavy management planes directly to the public internet, or locking everything behind a VPN so tightly that collaborating and sharing public work becomes a chore.

In Project Smörgåsbord</a>, we solved this by splitting our infrastructure into a Zero-Trust Public Edge Tier and an Encrypted Compute & Storage Core, paired with a zero-JavaScript static publishing pipeline driven directly from Obsidian.

1. Two-Tier Split-Horizon Architecture</h2>
Rather than treating every workload the same, we enforce a strict boundary between public edge ingress and local stateful storage:

Zero-Trust Public Edge (Cloudflare Tunnels + Dual Nordic WireGuard Relays):
HTTP/HTTPS services—including this blog (`blog.leander.media</code> / leander.media</code>), our real-time communication suite (Stoat Chat (chat.leander.media</code>)</a>), our bilingual compliance portal (info.leander.media</code></a>), webmail (mail.leander.media</code></a>), and GitLab HTTPS/Registry (gitlab.leander.media</code></a> / registry.leander.media</code></a>)—are routed through isolated container networks and dedicated Cloudflare Zero Trust HTTP/2 Tunnels.</li>`
Latency-sensitive UDP WebRTC voice/video media, Matrix federation (matrix.leander.media</code> / turn.leander.media</code>), Git SSH (ssh.gitlab.leander.media</code>), multiplayer game traffic (mc</code>, swamp</code>, ftb</code>, vh.leander.media</code>), and inbound/outbound mail protocols traverse dedicated Nordic cloud relays in Helsinki (hel1.leander.media</code>) and Stockholm (mx.leander.media</code>) over kernel WireGuard, keeping origin hardware completely unexposed to public port scanners.</li>
`Static properties are compiled ahead-of-time into pure HTML5 and CSS with fluid responsive typography (clamp(96%, 46% + 0.45vw, 126%)</code>) and 0 KB of third-party JavaScript.</li> </ul> </li>`
`Sovereign Compute & Storage Core:`All stateful databases, Git repositories, object stores, Syncthing vaults, hardware EDA verification runners (see Automated Hardware & KiCad EDA Verification Pipeline</a>), and audio DSP workstations (see RekordRescue & Real-Time Audio/DSP Tooling</a>) run on local hardware under our physical control.</li> </ul> </li> </ol> Why Publish Directly from Obsidian via Syncthing?</div> Writing technical documentation in a browser CMS breaks flow. By syncing our Obsidian vault peer-to-peer over Syncthing to our build server, any Markdown note saved in 05 Blog/</code> or 06 Portfolio/</code> with draft: false</code> is preprocessed, scrubbed of EXIF metadata, and compiled by Zola in under 50 milliseconds. </div></aside> 2. Core Platform Pillars (leander.media</code>)</h2> A. Self-Hosted GitLab CE 19.5 (gitlab.leander.media</code>)</h3> Our self-hosted code forge runs GitLab Community Edition 19.5 backed by PostgreSQL 17. It hosts: Public Open-Source Mirrors & Releases: Including the complete client/server mirrors and pre-configured binary builds for Stoat Chat (gitlab.leander.media/services/chat</code>)</a> and the source code for our Legal & Info Hub (gitlab.leander.media/services/info-portal</code>)</a>.</li> Private Infrastructure & R&D Repositories: Versioned Docker Compose stacks, autonomous KiCad ERC/DRC hardware verification pipelines, and automated backups of the Obsidian knowledge vault itself.</li> </ul> B. Sovereign Mail (mail.leander.media</code>) & Real-Time DMARC Telemetry</h3> Running a reliable self-hosted mail stack requires careful attention to IP reputation and cryptographic authentication: Stalwart Mail Server + SnappyMail: Handles IMAP4/SMTP with dual 2048-bit RSA and Ed25519 DKIM signing, strict SPF, and DMARC policy enforcement, paired with a clean webmail interface at mail.leander.media</code></a> where role addresses (admin@</code>, contact@</code>, abuse@</code>, dmarc@</code>) automatically sync into dedicated folders and Send-As identities.</li> Authenticated Outbound TLS Relay: Outbound external delivery routes through an authenticated European SMTP TLS relay so residential or cloud subnet blocks never impact deliverability.</li> Automated DMARC-to-Grafana Pipeline: A custom Python telemetry daemon parses incoming XML/ZIP aggregate DMARC reports (rua</code>) in real time and exports Prometheus metrics (dmarc_messages_total</code>, dmarc_dkim_pass_total</code>, dmarc_spf_pass_total</code>) into VictoriaMetrics and Grafana.</li> </ul> C. Centralized Identity (auth.leander.media</code>) & Bilingual Legal Hub (info.leander.media</code>)</h3> Zitadel OIDC Single Sign-On: Provides passwordless WebAuthn/Passkey and OAuth 2.0 PKCE authentication across internal and public services.</li> Bilingual (FI</code> / EN</code>) Compliance Portal: info.leander.media</code></a> serves our GDPR Privacy Policy, Terms of Service, EULA, Open-Source Licensing attributions, and EU Digital Services Act (DSA) contact points with automatic Finnish/English browser language detection.</li> </ul> 3. Automatic EXIF Scrubbing & Media Optimization</h2> When blogging from a phone in the workshop—taking photos of a custom PCB or a 16kW mountainboard battery spine—raw camera JPEGs contain sensitive EXIF metadata including GPS coordinates and device serial numbers. Our watcher daemon intercepts every ![[photo.jpg|Caption]]</code> embed and runs exiftool -all=</code> plus responsive WebP generation before Zola builds the static site: def scrub_and_optimize_image(src_path: Path, dst_clean: Path, dst_webp: Path) -> None: """Strip all EXIF metadata (GPS, serials) and generate a responsive 1600px WebP.""" with Image.open(src_path) as img: img_rgb = ImageOps.exif_transpose(img) # Creating a fresh Image copy without passing info/exif strips all EXIF tags clean = Image.new(img_rgb.mode, img_rgb.size) clean.putdata(list(img_rgb.getdata())) clean.save(dst_clean, optimize=True) # Generate fast-loading WebP (max 1600px width) clean.thumbnail((1600, 1600), Image.Resampling.LANCZOS) clean.save(dst_webp, format="WEBP", quality=85, method=6) </code></pre> </a>Live EXIF Scrubbing Verification — Source JPEG contained GPS coordinates; published JPEG & WebP contain 0 EXIF tags</figcaption></figure> 4. What’s Next</h2> Check out our companion guide—Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & How to Get Started</a>—to hop onto our chat and voice platform, or subscribe via the RSS feed</a> / Atom feed</a> for upcoming deep dives into our autonomous KiCad EDA verification pipeline</a> and real-time audio DSP tooling</a>.



Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide
Unknown — Sat, 24 Oct 2026 00:00:00 +0000
As part of the Leander.Media Sovereign Cloud Platform</a></strong>, we wanted a fast, modern real-time messaging, voice, and screen-sharing platform for friends and collaborators—without handing our conversations, voice streams, or social graph over to third-party ad-tech platforms.</p>
Today, chat.leander.media</code></a></strong> is live, powered by Stoat Chat (v0.15</code>)</strong>, integrated with Zitadel OIDC Single Sign-On (auth.leander.media</code>)</strong>, backed by a Nordic LiveKit WebRTC voice/video edge relay</strong>, and paired with pre-configured desktop and mobile apps hosted on our public GitLab forge.</p>
1. Click Invite or Visit</strong>chat.leander.media</span></div>2. Authenticate via Zitadel SSO</strong>(auth.leander.media)</span></div>3. Auto-Provisioned Session</strong>(stoat-user / stoat-admin)</span></div>4. Chat, Voice & Screen Share</strong>(Web, Windows, Linux, Android)</span></div></div></figure>

1. How to Get Started (chat.leander.media</code>)</h2>
Joining takes less than a minute and works immediately in your browser, on your desktop, or on your phone.</p>
Step 1: Open Your Invite Link or Sign In with SSO</h3>
Access to chat.leander.media</code> is invite-only and protected by Leander.Media Single Sign-On (Zitadel)</strong>:</p>

If you received an Invite Link (https://chat.leander.media/invite/<code></code> or /sso/register/<code></code>):</strong>

Click the invite link in your browser.</li>
It automatically validates your invite token and redirects you to https://auth.leander.media</code></strong> to log in or complete your account setup.</li>
Once authenticated, our OIDC bridge automatically grants your account access, provisions your Stoat profile, and logs you straight into the chat!</li>
</ul>
</li>
If you already have a leander.media</code> SSO account:</strong>

Visit https://chat.leander.media</code></a></strong> and click Sign in with Leander.Media SSO (Zitadel)</strong> (or go directly to https://chat.leander.media/sso/login</code></a></strong>).</li>
</ul>
</li>
</ol>
Zero Separate Chat Password Needed in the Browser</div>
When signing in via Leander.Media SSO</strong>, our OIDC PKCE bridge authenticates your Zitadel identity, mints an active Stoat session directly into your browser storage, and takes you straight into your channels with a single click.</p>
</div></aside>

Step 2: Download the Pre-Configured Desktop & Mobile Apps (v1.0.0-leander</code>)</h3>
While the Web App (https://chat.leander.media</code>)</a></strong> works out of the box in any browser, we also maintain and build native desktop and mobile clients pre-configured to connect directly to https://chat.leander.media</code></strong> by default—no manual custom server URL typing required.</p>
All runnable single-file binaries and full source code are available on our public GitLab release page:</p>

Release Hub:</strong> https://gitlab.leander.media/services/chat/stoat/-/releases/v1.0.0-leander</code></a></strong></li>
</ul>
Platform</th> Package Type</th> Direct Download Link</th> Notes</th></tr></thead>

Windows (x64)</strong></td> Setup Installer (.exe</code>)</td> Stoat-Desktop-Windows-Setup.exe</a></td> Standard Windows desktop installer with tray & notifications.</td></tr>
Windows (x64)</strong></td> Portable Binary (.exe</code>)</td> Stoat-Desktop-Windows-Portable.exe</a></td> Single-file executable — run from anywhere with zero install.</td></tr>
Linux (x86_64)</strong></td> Debian / Ubuntu (.deb</code>)</td> Stoat-Desktop-Linux-amd64.deb</a></td> Install via sudo apt install ./Stoat-Desktop-Linux-amd64.deb</code>.</td></tr>
Linux (x86_64)</strong></td> Portable (.AppImage</code>)</td> Stoat-Desktop-Linux-x86_64.AppImage</a></td> chmod +x Stoat-Desktop-Linux-x86_64.AppImage && ./Stoat-Desktop-Linux-x86_64.AppImage</code>.</td></tr>
Android (ARM64)</strong></td> Signed Release (.apk</code>)</td> Stoat-Android-arm64-v8a-release.apk</a></td> Native Kotlin/Compose Android app pre-pointed at chat.leander.media</code>.</td></tr>
Web Bundle</strong></td> Self-Hosted Static (.zip</code>)</td> Stoat-Web-SelfHosted-Dist.zip</a></td> Pre-built static web bundle for offline auditing or local hosting.</td></tr>
</tbody></table>

2. Under the Hood: Architecture & Privacy</h2>
A. Zitadel OIDC Bridge & Invite Portal</h3>
Upstream Stoat/Revolt uses standalone email/password authentication via Shield. To unify identity across leander.media</code> without forking the core Rust database schema, we built a lightweight OIDC PKCE Bridge (sso-bridge</code>)</strong> sitting alongside the API behind Caddy:</p>

Validates OAuth 2.0 Authorization Code + PKCE</strong> flows against https://auth.leander.media</code>.</li>
Enforces Zitadel role assertions (stoat-user</code> and stoat-admin</code>) before provisioning or issuing sessions.</li>
Includes a built-in Admin Invite Portal (/sso/invites</code>)</strong> allowing stoat-admin</code> members to generate single-use or time-limited onboarding links on the fly.</li>
</ul>
B. Low-Latency Nordic LiveKit WebRTC Voice & Video</h3>
WebRTC voice and screen sharing require direct UDP/TCP media streams (LiveKit SFU</code>), which cannot pass through standard HTTP-only reverse proxies without adding latency:</p>

Voice and video traffic routes through a dedicated Nordic cloud relay over a kernel WireGuard tunnel</strong>.</li>
Clients establish WebRTC media streams with sub-15ms regional latency while the underlying homelab origin IP remains 100% shielded.</li>
</ul>
C. Open Source & Transparency</h3>
In keeping with our open-source licensing commitments, every line of client and deployment code is published under https://gitlab.leander.media/services/chat</code></strong>:</p>

services/chat/stoat</code></a></strong> — Master hub & release deliverables (v1.0.0-leander</code>)</li>
services/chat/for-desktop</code></a></strong> — Electron desktop client source</li>
services/chat/for-android</code></a></strong> — Android native client source</li>
services/chat/for-web</code></a></strong> — SolidJS web client source</li>
services/chat/stoatchat</code></a></strong> — Rust backend services (Delta API, Bonfire WebSocket, Autumn, January)</li>
services/chat/self-hosted</code></a></strong> — Sanitized Docker Compose stack & Zitadel OIDC bridge</li>
</ul>
For full details on data handling, GDPR privacy rights, and open-source licenses, visit https://info.leander.media</code></a></strong>.</p>


Project Smörgåsbord: Two-Tier Sovereign Cloud & Zero-Trust Mesh
Unknown — Sat, 24 Oct 2026 00:00:00 +0000
Overview</h2>
Project Smörgåsbord</strong> is the sovereign, self-hosted infrastructure platform powering leander.media</code>—combining local Proxmox virtualization and high-capacity storage with stateless Cloudflare Zero Trust tunnels and a Nordic WireGuard edge relay.</p>
Design Philosophy</div>
Keep stateful data, Git repositories, Syncthing vaults, mail storage, and high-compute workloads on local hardware you physically control, while using stateless encrypted tunnels and cloud edge relays for zero-trust public ingress, WebRTC media routing, and high-deliverability mail transport.</p>
</div></aside>
Key Subsystems</h2>
1. Split-Horizon WireGuard Edge & Zero-Trust Ingress</h3>

HTTP/HTTPS workloads are isolated per stack behind dedicated Cloudflare Zero Trust Tunnels</strong> (leander.media</code>, blog.leander.media</code>, chat.leander.media</code>, info.leander.media</code>, mail.leander.media</code>, biohacking.leander.media</code>, djtools.leander.media</code>, gitlab.leander.media</code>, registry.leander.media</code>).</li>
Latency-sensitive UDP WebRTC voice/video streams (chat.leander.media</code>, turn.leander.media</code>), Matrix S2S federation (matrix.leander.media</code>), Git SSH (ssh.gitlab.leander.media</code>), dedicated game servers (mc</code>, swamp</code>, ftb</code>, vh.leander.media</code>), and inbound/outbound SMTP/IMAPS mail connections traverse dedicated kernel WireGuard tunnels</strong> to Nordic cloud edge relays in Helsinki (hel1.leander.media</code>) and Stockholm (mx.leander.media</code>), keeping the home origin network completely unexposed (0</code> residential WAN IP records in public DNS).</li>
</ul>
2. Self-Hosted GitLab CE 19.5 (gitlab.leander.media</code>, ssh.gitlab.leander.media</code> & registry.leander.media</code>)</h3>

Self-hosted GitLab Community Edition 19.5</strong> and GitLab Container Registry (registry.leander.media</code>)</strong> hosting public open-source mirrors/releases, OCI container images, and private engineering repositories behind a dedicated Cloudflare HTTP/2 Tunnel and a 2 ms Helsinki WireGuard SSH relay (ssh.gitlab.leander.media</code>).</li>
Powers automated CI/CD verification for hardware EDA designs, container builds, and versioned backups of our Obsidian knowledge base.</li>
</ul>
3. Sovereign Mail (mail.leander.media</code>) & DMARC Security Pipeline</h3>

Stalwart Mail Server + SnappyMail Webmail</strong> configured with dual RSA-2048 & Ed25519 DKIM signing, strict SPF, and DMARC enforcement, paired with an authenticated European outbound TLS relay.</li>
Custom DMARC Prometheus Exporter</strong> parses aggregate XML/ZIP reports in real time and feeds VictoriaMetrics</strong> and Grafana</strong> security dashboards.</li>
</ul>
4. Zitadel OIDC Identity (auth.leander.media</code>) & Bilingual Info Hub (info.leander.media</code>)</h3>

Centralized Zitadel OIDC</strong> identity provider supporting Passkeys/WebAuthn and OAuth 2.0 PKCE across internal and external portals.</li>
Standalone bilingual (FI</code> / EN</code>) compliance portal at info.leander.media</code></a></strong> (public source repo</a>) serving GDPR privacy documentation, Terms of Service, EULA, and open-source attributions.</li>
</ul>
5. Zero-JS Obsidian-to-Zola Publishing Engine</h3>

Real-time Syncthing</strong> replication from desktop and mobile Obsidian vaults directly to our build pipeline.</li>
Automated exiftool</code> + Pillow preprocessor strips EXIF/GPS metadata from camera photos, converts Obsidian callouts and wikilinks, and triggers sub-50ms Zola</strong> static builds with 0 KB</code> of client-side JavaScript.</li>
</ul>
# Compile-time syntax highlighting & zero client-side JavaScript
</span>base_url </span>= </span>"https://blog.leander.media"
</span>compile_sass </span>= </span>false
</span>generate_feeds </span>= </span>true
</span>feed_filenames </span>= [</span>"atom.xml"</span>, </span>"rss.xml"</span>]
</span>
</span>[</span>markdown</span>]
</span>highlight_code </span>= </span>true
</span>highlight_theme </span>= </span>"ayu-dark"
</span></code></pre>
Related Writeups</h2>

Read the architecture deep dive: Designing a Two-Tier Sovereign Cloud, Mail & Zero-JS Publishing Platform</a></strong></li>
Join the chat platform: Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide</a></strong></li>
Explore the hardware CI/CD stack: Automated Hardware & KiCad EDA Verification Pipeline</a></strong></li>
</ul>


Stoat Chat (chat.leander.media): Sovereign Real-Time Messaging, OIDC SSO & WebRTC Voice
Unknown — Sat, 24 Oct 2026 00:00:00 +0000
Overview</h2>
Stoat Chat (chat.leander.media</code>)</a></strong> is our sovereign real-time messaging, voice, and screen-sharing platform—built on the open-source Stoat (v0.15</code>) stack, integrated with Zitadel OIDC Single Sign-On (auth.leander.media</code>)</strong>, and distributed with pre-configured desktop and mobile applications.</p>
Key Engineering Highlights</h2>
1. Custom Zitadel OIDC PKCE Bridge & Invite Manager (/sso</code> & /sso/invites</code>)</h3>

Implements OAuth 2.0 Authorization Code + PKCE</strong> authentication against https://auth.leander.media</code>.</li>
Enforces Zitadel project role assertions (stoat-user</code> and stoat-admin</code>) and automatically provisions Stoat user accounts and active browser sessions on login.</li>
Provides a built-in Invite Management Portal (/sso/invites</code>)</strong> for minting time- and use-limited invite links (https://chat.leander.media/invite/<code></code>).</li>
Supports long-form engineering logs and code snippets natively with a patched 40,000-character message limit</strong> across the Rust API and all clients.</li>
</ul>
2. Nordic WireGuard LiveKit WebRTC Voice & Video Relay</h3>

Routes LiveKit SFU</strong> WebRTC UDP/TCP media streams through a dedicated Nordic cloud edge node over a kernel WireGuard tunnel.</li>
Delivers low-latency voice channels and HD screen sharing while keeping the home origin network completely hidden from public ICE candidates.</li>
</ul>
3. Pre-Configured Multi-Platform Client Deliverables (v1.0.0-leander</code>)</h3>
All client repositories are mirrored and built under https://gitlab.leander.media/services/chat</code></a></strong> with https://chat.leander.media</code> baked in as the default server endpoint:</p>

Release Downloads:</strong> v1.0.0-leander</code> Release Page</a></strong> (Windows .exe</code> Installer & Portable, Linux .deb</code> & .AppImage</code>, Android signed .apk</code>, and Web .zip</code>).</li>
Getting Started Guide:</strong> Read Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide</a></strong>.</li>
</ul>


Automated Hardware & KiCad EDA Verification Pipeline
Unknown — Tue, 20 Oct 2026 00:00:00 +0000
Overview</h2>
Designing custom electronics—from 16kW electric mountainboard power distribution spines (14S4P)</strong> to modular mini line-array DSP amplifiers</strong>—traditionally suffers from manual ERC/DRC checks, fragmented CAD files, and slow design-for-manufacturing (DFM) feedback loops.</p>
The Automated Hardware & KiCad EDA Verification Pipeline</strong> brings modern software CI/CD rigor to physical hardware engineering.</p>
Deterministic Hardware Revisions</div>
Every schematic, PCB layout, and 3D enclosure iteration is tracked in a Git timeline with automated Design Rule Checks (DRC), interactive 3D STEP/GLB model diffing, and one-click owner approval gates before fabrication files (Gerbers, BOM, PnP, 3MF) are emitted.</p>
</div></aside>
Architecture & Capabilities</h2>
1. Programmatic KiCad ERC/DRC & Fab Artifact Generation</h3>

Headless verification runners execute electrical and physical rule checks on every commit.</li>
Automated generation of fabrication-ready Gerber archives, interactive HTML BOMs, and pick-and-place centroids.</li>
</ul>
2. Merged 3D CAD Workbench & Git Timeline Viewer</h3>

Unified browser workbench featuring an interactive 3D model viewer alongside revision history timelines.</li>
Supports rapid mechanical iteration with pre-configured Creality</strong> slicing presets for functional enclosure prototyping before committing to CNC aluminum or injection molding.</li>
</ul>
# Example: Headless pipeline stage contract for hardware revision verification
</span>pipeline_stages </span>= </span>[
</span>    </span>"spec_guided_synthesis"</span>,
</span>    </span>"kicad_erc_drc_verify"</span>,
</span>    </span>"cad_3d_mesh_export"</span>,
</span>    </span>"creality_slice_validation"</span>,
</span>    </span>"owner_approval_gate"</span>,
</span>]
</span></code></pre>
3. Hardware Projects Built with the Pipeline</h3>

16kW Esk8 Mountainboard Power System:</strong> 14S4P high-discharge copper-spine battery pack engineering and VESC telemetry integration.</li>
Modular Mini Line Array PoC:</strong> Compact acoustic array enclosures paired with multi-channel Class-D amplification and DSP crossover networks (see RekordRescue & Real-Time Audio/DSP Tooling</a></strong>).</li>
</ul>


RekordRescue & Real-Time Audio/DSP Tooling
Unknown — Sun, 18 Oct 2026 00:00:00 +0000
Overview</h2>
Spanning studio production in REAPER</strong>, live hard-dance / electronic DJ performance, and our browser-based DJTools Audio Studio (djtools.leander.media</code>)</a></strong>, RekordRescue & Real-Time Audio/DSP Tooling</strong> is a suite of custom audio tools built for reliability, surgical low-end control, stem separation, and automated library management.</p>
Zero-Latency Live & Studio Workflows</div>
By combining sample-accurate JSFX</strong> DSP scripts inside REAPER with Python-based library and stem automation, complex bass synthesis and stem separation tasks run deterministically on local hardware.</p>
</div></aside>
Core Tools & Modules</h2>
1. Custom JSFX Sub-Bass & Reverse-Bass DSP Engine</h3>

Real-time REAPER JSFX</strong> synthesis and dynamics processors tailored for reverse-bass tail sculpting, phase-coherent sub-bass reinforcement, and transient shaping.</li>
Live hot-patching and parameter telemetry integration via REAPER’s HTTP/OSC control surface APIs.</li>
</ul>
// JSFX sample-accurate one-pole envelope follower & soft-clipping saturator
</span>@sample
</span>env </span>= </span>max</span>(</span>abs</span>(spl0)</span>,</span> env </span>*</span> release_coeff)</span>;
</span>drive_spl0 </span>=</span> spl0 </span>*</span> pre_gain</span>;
</span>spl0 </span>=</span> drive_spl0 </span>/ </span>(</span>1</span>.</span>0 </span>+ </span>abs</span>(drive_spl0))</span>;
</span>spl1 </span>=</span> spl0</span>;
</span></code></pre>
2. Automated REAPER Stem Extractor</h3>

High-throughput stem separation pipeline integrating neural source separation models directly into REAPER project timelines.</li>
Automatically splits full masters into isolated vocal, drum, bass, and synth stems with phase-aligned routing and tempo-synced markers for remixing and live DJ sets.</li>
</ul>
3. RekordRescue Library & Setlist Tooling</h3>

Python utilities for inspecting, repairing, and migrating DJ metadata, cue points, beatgrids, and relocated audio files across storage volumes without losing performance preparation work.</li>
Connects with our broader homelab storage infrastructure (Project Smörgåsbord</a></strong>) so studio renders and DJ libraries stay backed up via Syncthing.</li>
</ul>

Jimi Leander — Hardware, Audio/DSP & Sovereign Infrastructure

Designing a Two-Tier Sovereign Cloud, Mail & Zero-JS Publishing Platform

1. Two-Tier Split-Horizon Architecture</h2> Rather than treating every workload the same, we enforce a strict boundary between public edge ingress and local stateful storage:</p> Zero-Trust Public Edge (Cloudflare Tunnels + Dual Nordic WireGuard Relays):</strong></p>

C. Centralized Identity (auth.leander.media</code>) & Bilingual Legal Hub (info.leander.media</code>)</h3> Zitadel OIDC Single Sign-On:</strong> Provides passwordless WebAuthn/Passkey and OAuth 2.0 PKCE authentication across internal and public services.</li>

Stoat Chat on Leander.Media: Sovereign Real-Time Messaging, Voice & Getting Started Guide

2. Under the Hood: Architecture & Privacy</h2>

Project Smörgåsbord: Two-Tier Sovereign Cloud & Zero-Trust Mesh

Overview</h2> Project Smörgåsbord</strong> is the sovereign, self-hosted infrastructure platform powering leander.media</code>—combining local Proxmox virtualization and high-capacity storage with stateless Cloudflare Zero Trust tunnels and a Nordic WireGuard edge relay.</p>

Key Subsystems</h2>

5. Zero-JS Obsidian-to-Zola Publishing Engine</h3> Real-time Syncthing</strong> replication from desktop and mobile Obsidian vaults directly to our build pipeline.</li>

Stoat Chat (chat.leander.media): Sovereign Real-Time Messaging, OIDC SSO & WebRTC Voice

2. Nordic WireGuard LiveKit WebRTC Voice & Video Relay</h3> Routes LiveKit SFU</strong> WebRTC UDP/TCP media streams through a dedicated Nordic cloud edge node over a kernel WireGuard tunnel.</li>

Automated Hardware & KiCad EDA Verification Pipeline

RekordRescue & Real-Time Audio/DSP Tooling