Comm App - Self-Hosted Alternative to Signal, Wire, WhatsApp, Telegram

[robi]

Comm

Comm is an E2E-encrypted messaging app. You can think of it as Signal with an IRC-like federated community layer.

• DMs and group chats are E2EE between devices using pairwise Double Ratchet sessions initiated via X3DH.
• Communities, which consist of a tree structure of channels, are hosted on federated user-run backends that we call keyservers. Communication is encrypted via TLS.

Learn more at comm.app!

Repo structure

The client apps and keyserver layer are mostly written in Flow-typed Javascript. These projects are organized in a monorepo structure using Yarn Workspaces.

• native contains the code for the React Native app, which supports both iOS and Android.
• keyserver contains the code for the Node/Express server. This includes the application server for the communities layer (the "keyserver"), and can be configured to serve web and landing as well (see below).
• web contains the code for the React desktop website.
• landing contains the code for the Comm landing page.
• lib contains code that is shared across multiple other workspaces, including most of the Redux stack that is shared across native/web.

Comm's backend services are centralized and never touch plaintext data. They are written in Rust and deployed with Terraform to AWS. These projects are organized in a monorepo structure using Cargo Workspaces.

• services contains the various different backend services.
• shared contains gRPC and protobuf definitions, and shared Rust libraries.

I am in touch with the developer.

[humptydumpty]

If this gets packaged and we self-host it, all msgs go through our servers and not AWS or another 3rd party, right?

[robi]

@humptydumpty yes, that is correct.

[micmc]

Wow, that's sounds impressive and useful, however shame on them-seriously-for NOT creating an Linux version in 2025, and moreover while this user base is exploding... Where is this "server" supposed to be hosted exactly, if not on Linux?

Moreover, you see, while crying out for ID "protection", to get to "comm web" we STILL need to somehow be IDentified by either G, A, or M, just among the 3 WORST privacy violators, cause we can only scan a QR code to DOWNLOAD the an APP ON MY PHONE to access the server ??? What a BS, sorry...
... a pretty weird approach imho