Activity

1. Cod-e-Codes commented on Feb 19, 2026

   

   Cod-e-Codes

   on Feb 19, 2026

   Last edited by Cod-e-Codes

   Owner

   More actions

   Thanks for the detailed report and for running the test suite.

   The error:

   Error initializing keystore: failed to decrypt keystore: cipher: message authentication failed

   is coming from AES-GCM when trying to decrypt your existing keystore file. That usually means either:

   • the keystore passphrase doesn’t match what was used when the file was created, or
   • the keystore was written with an older key-derivation scheme and the current version can’t decrypt it.

   Recently I changed the keystore key derivation from a simple SHA256-based scheme to PBKDF2. The JSON format is backward-compatible, but the encryption key is not, so older keystore.dat files can’t be decrypted by newer builds even with the same passphrase.

   If you don’t need to keep the existing keystore contents, the simplest fix is to remove only the keystore file and let marchat create a new one. You can keep your profiles and use the same passphrase:

   • On Linux (default config location):

     rm ~/.config/marchat/keystore.dat

   • Then run marchat-client again, pick your existing profile, and enter the same keystore passphrase. A new keystore file will be created with that passphrase.

   If you’re sure this is a brand‑new install and there was no older keystore, then it’s likely a passphrase mismatch (e.g. admin key vs keystore passphrase, or a typo). Removing keystore.dat and starting that profile again with the correct passphrase should fix it.

   I’ll look at adding a clearer error message and a migration path for old keystores so this is less confusing. Thanks for surfacing it.

   Quick question to help confirm: did this start happening after updating marchat from an older version, or is this a fresh install on this machine?
2. Blue-Azure commented on Feb 19, 2026

   

   Blue-Azure

   on Feb 19, 2026

   Author

   More actions

   I just started setting up marchat yesterday, and I didn't update as it was already the latest update. I would also like help setting up access to the chatroom without having to use ssh
3. Blue-Azure

   changed the title [-]keystore issue[/-] [+]Setting up Marchat [/+] on Feb 19, 2026
4. Cod-e-Codes commented on Feb 19, 2026

   

   Cod-e-Codes

   on Feb 19, 2026

   Owner

   More actions

   Got it, thanks for clarifying.

   You don’t need SSH access for clients to join a marchat server. SSH is only required if you’re managing the machine the server is running on.

   If your intention is to run everything locally (for example on a home network), you just need:

   • marchat-server running on one machine
   • marchat-client running on any other machines (or the same one)

   As long as the server is reachable over the network and the client is configured with the correct server URL, that’s all that’s required for clients to connect.

   To connect remotely (outside your local network), you’ll also need:

   • The server running and reachable on a public address/IP
   • The WebSocket port (default :5555) open/forwarded
   • The correct server URL in the client (for example ws://your-server-ip:5555/ws, or wss:// if TLS is enabled)

   Typical setups are:

   • Port forwarding on your router if the server is on a home network
   • Running the server on a VPS
   • Using a tunnel or reverse proxy (Cloudflare Tunnel, etc.)
5. Blue-Azure commented on Feb 19, 2026

   

   Blue-Azure

   on Feb 19, 2026

   Author

   More actions

   how would i set up TLS, the readme is vague on that, but incredibly extensive on everything else
6. Blue-Azure commented on Feb 19, 2026

   

   Blue-Azure

   on Feb 19, 2026

   Author

   More actions

   well, actually, what does TLS give you? all im aware is that is secure, but that's all i know
7. Cod-e-Codes commented on Feb 19, 2026

   

   Cod-e-Codes

   on Feb 19, 2026

   Owner

   More actions

   What TLS gives you

   • Encryption in transit – Traffic between client and server (including your admin key and keystore passphrase when you type them) is encrypted. Without TLS, anyone on the same network can sniff that traffic.
   • Server identity – With proper (CA-signed) certificates, clients can confirm they’re talking to your server and not an impersonator.
   • Integrity – The connection detects if someone is altering data in flight.

   So: no TLS = fine for localhost or a trusted LAN. TLS = what you want if the server is on the internet or any network you don’t fully trust.

   How to set up TLS with marchat

   1. Get a certificate and key. Two options:

      • Self-signed (testing / personal use):

        openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365 -nodes

        Use wss:// and --skip-tls-verify on the client (see below).
      • Production: Use a real certificate (e.g. Let’s Encrypt with certbot). Use the full chain for the cert file and the private key for the key file.

   2. Run the server with TLS: Set both env vars (marchat enables TLS only when both are set), then start the server:

      export MARCHAT_ADMIN_KEY="your-key"
      export MARCHAT_USERS="admin1,admin2"
      export MARCHAT_TLS_CERT_FILE="/path/to/cert.pem"
      export MARCHAT_TLS_KEY_FILE="/path/to/key.pem"
      ./marchat-server

      Default port is 8080 (or set MARCHAT_PORT if you use something else, e.g. 5555). The banner will show WebSocket: wss://<addr>/ws and TLS: Enabled when TLS is active.

   3. Connect the client over TLS: Use wss:// and the same host and port as the server:

      ./marchat-client --server wss://your-server:8080/ws

      If you’re using a self-signed cert:

      ./marchat-client --skip-tls-verify --server wss://your-server:8080/ws

      (Use your actual port if you set MARCHAT_PORT.)

   If you run marchat behind nginx/traefik/Cloudflare, you can terminate TLS there and keep marchat on ws:// locally; the README’s “HTTPS reverse proxies” note refers to that pattern.
8. Blue-Azure commented on Feb 19, 2026

   

   Blue-Azure

   on Feb 19, 2026

   Author

   More actions

   okay. thank you, are there any recommended clients like termux to use on apple? termux only has paid offbrands on apple because apple bad.
   i was thinking having a bunch of isolated ttys with nothing but marchat on them but that will go about as well-not at all
9. Blue-Azure commented on Feb 19, 2026

   

   Blue-Azure

   on Feb 19, 2026

   Author

   More actions

   also, where would the environment variables be?
10. Cod-e-Codes commented on Feb 19, 2026

    

    Cod-e-Codes

    on Feb 19, 2026

    Last edited by Cod-e-Codes

    Owner

    More actions

    Apple / clients

    • macOS: Use the darwin build (darwin-amd64 or darwin-arm64 from the releases). Run marchat-client in Terminal.app, iTerm2, or any terminal. No extra “client” app. It’s just the binary.
    • iOS (iPhone/iPad): There’s no marchat client for iOS. Termux-style environments aren’t available the same way on Apple’s app store, and marchat doesn’t ship an iOS app. The only option is to SSH into a machine (e.g. a VPS or a Raspberry Pi) and run marchat-client there, so you’re using marchat from that host, not natively on the phone.

    Where to put the environment variables

    You can do either of these:

    1. Same terminal session – Before starting the server, run:

       export MARCHAT_ADMIN_KEY="your-key"
       export MARCHAT_USERS="admin1,admin2"
       export MARCHAT_TLS_CERT_FILE="/path/to/cert.pem"
       export MARCHAT_TLS_KEY_FILE="/path/to/key.pem"
       # ... any others
       ./marchat-server

    2. .env in the server’s config directory – The server loads a .env file from its config directory. Create a file named .env there with one KEY=value per line (no export), for example:

       MARCHAT_ADMIN_KEY=your-key
       MARCHAT_USERS=admin1,admin2
       MARCHAT_TLS_CERT_FILE=/path/to/cert.pem
       MARCHAT_TLS_KEY_FILE=/path/to/key.pem
       MARCHAT_PORT=5555
       

       The config directory is usually ./config when you run the server from the repo directory, or ~/.config/marchat otherwise (or whatever you set with MARCHAT_CONFIG_DIR). So the file would be e.g. ./config/.env or ~/.config/marchat/.env.
11. Blue-Azure commented on Feb 19, 2026

    

    Blue-Azure

    on Feb 19, 2026

    Author

    More actions

    whats the admin key
12. Cod-e-Codes commented on Feb 19, 2026

    

    Cod-e-Codes

    on Feb 19, 2026

    Last edited by Cod-e-Codes

    Owner

    More actions

    The admin key is a secret you choose when you set up the server. Marchat doesn’t generate or assign it.

    • Server: You set it with MARCHAT_ADMIN_KEY (in the environment or in the server’s .env). That value is the “admin key” for your instance.
    • Client: When connecting as admin, you must supply the same value, via the “Admin Key” prompt or --admin-key, so the server can verify you.

    So it’s one shared secret: whatever you put in MARCHAT_ADMIN_KEY on the server is the admin key you use on the client when logging in as an admin user.
13. Blue-Azure commented on Feb 19, 2026

    

    Blue-Azure

    on Feb 19, 2026

    Author

    More actions

    thank you, i wrote .env to the marchat root folder but it doesnt seem to accept my config as the port and TLS hasn't changed
14. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    nvm while looking for config to point to i i found it was somewhere else xD
15. Cod-e-Codes commented on Feb 20, 2026

    

    Cod-e-Codes

    on Feb 20, 2026

    Owner

    More actions

    Why your .env isn't used

    The server only loads a .env file from its config directory, not from the marchat repo root.

    • If you start the server from the repo (where go.mod is), the config directory is ./config (a config folder next to go.mod). Put your .env there: config/.env.
    • If you run the server from somewhere else (or without go.mod in the current dir), the config directory is usually ~/.config/marchat. Then the file must be ~/.config/marchat/.env.

    So: move (or copy) your .env into that config directory (e.g. config/.env when running from the repo) and restart the server. Port and TLS are read from that file once it's in the right place.
16. 31 remaining items

    Load more

17. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    here is localhost ig

    Screencast_20260219_174827.webm
18. Cod-e-Codes commented on Feb 20, 2026

    

    Cod-e-Codes

    on Feb 20, 2026

    Last edited by Cod-e-Codes

    Owner

    More actions

    TLS (wss://)
    If the server is running with TLS (you set MARCHAT_TLS_CERT_FILE and MARCHAT_TLS_KEY_FILE), use wss:// on the phone, e.g.:

    wss://PC_IP:5555/ws

    If the cert is self-signed, the client on the phone needs to be run with --skip-tls-verify so it accepts that cert.
    If the server is not using TLS, use ws:// instead of wss:// (e.g. ws://PC_IP:5555/ws).

    So: same idea as before (use the PC’s IP, not localhost), but with wss and the right port when TLS is on, and --skip-tls-verify for a self-signed cert.
19. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    any ideas
20. Cod-e-Codes commented on Feb 20, 2026

    

    Cod-e-Codes

    on Feb 20, 2026

    Owner

    More actions

    One thing that helps: connect a client from the same machine that’s running the server (e.g. a second terminal with marchat-client using ws://localhost:5555/ws or wss://localhost:5555/ws if you use TLS). If that works, server and config are fine and the problem is likely network or firewall between the phone and the PC. If it fails there too, fix that first (port, TLS, username, etc.), then try the phone again.
21. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    localhost wont work
22. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    i'll check the config
23. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    nothing's abnormal
24. Blue-Azure

    reopened this on Feb 20, 2026
25. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    idk how to fix it, i'd down for you to remote control if you wanna
26. Cod-e-Codes commented on Feb 20, 2026

    

    Cod-e-Codes

    on Feb 20, 2026

    Owner

    More actions

    One more thing to try: if you're on a self-signed cert, use --skip-tls-verify when launching the client, or set "skip_tls_verify": true for that profile in profiles.json. Calling it a night. We can pick this up tomorrow if it's still not working.
27. Blue-Azure commented on Feb 20, 2026

    

    Blue-Azure

    on Feb 20, 2026

    Author

    More actions

    okay, sleep well!
28. Cod-e-Codes commented on Mar 19, 2026

    

    Cod-e-Codes

    on Mar 19, 2026

    Owner

    More actions

    I need to see actual error output to help further. Videos of the UI don't show what's failing.

    Required diagnostic output:

    Server side:

    # Show startup output
    ./marchat-server 2>&1 | tee server-log.txt
    
    # Verify it's listening
    ss -tlnp | grep 5555  # or whatever port

    Client side (same machine as server):

    # Test local connection
    ./marchat-client --server ws://localhost:5555/ws --username TestUser 2>&1 | tee client-log.txt

    Paste the text output from both. Without actual error messages and server logs, I can't debug this.

    ---

    Important: This project assumes basic familiarity with:

    • Terminal/command-line usage
    • TCP/IP networking (localhost vs LAN vs internet)
    • Server administration basics
    • Reading error logs

    If you're new to self-hosting, I recommend:

    1. Start with the Docker image (simpler deployment)
    2. Get localhost working before attempting remote access
    3. Use GitHub Discussions for setup questions (Issues are for bugs)
29. Cod-e-Codes

    closed this as completedon Mar 19, 2026
30. Repository owner locked and limited conversation to collaborators on Mar 19, 2026
31. Cod-e-Codes

    converted this issue into a discussion #80 on Mar 19, 2026