Introduction

Gryt is a self-hosted voice, video and text chat platform. You run the server; it holds your messages and decides who may join. Voice and video go through a separate media service that never sees any of that.

Components

Component	Tech	Role
Client	React + TypeScript, Electron on the desktop	Interface, audio processing, WebRTC
Server	Node.js + TypeScript, SQLite	Chat, identity, permissions, invites
SFU	Go + Pion WebRTC	Media forwarding. One per machine
Image worker	Node.js + sharp	Thumbnails and compression, kept out of the server
Keycloak	Hosted at `auth.gryt.chat`	Signing in
Identity service	Hosted at `id.gryt.chat`	Signs the certificate that binds your key to your account
CLI	Go	Creates and runs servers from a terminal

How it works

You sign in to Keycloak, once, with OIDC and PKCE.
Your client generates a keypair that never leaves the device, and the identity service signs a certificate saying that key is yours.
Joining a server is a signed challenge. The server sends a nonce, your client signs it, and the server checks the signature against the certificate. Your Keycloak token is never sent to the server, so a server operator has no credential of yours to steal.
The server issues a token scoped to itself, and the client talks to it over a WebSocket for chat, presence and permissions.
Joining a voice channel gets you a room from the SFU. Media goes straight to the SFU over one UDP port and never touches the server.

Security has the whole handshake, and Do I need an account? covers joining without one, which is also supported.