Open source: Operalytix Messenger (AGPL-3.0)

The repository

The source lives at github.com/evlvstch/operalytixmessanger. It is not public yet; it has to be opened before the app is distributed, because the App Store permission below depends on it. The app links to it under Settings > About > Source Code.

What is in it

core/: the Rust core with the messaging protocol, cryptography, storage and the embedded Tor client.
relay/: the Rust relay, an untrusted store-and-forward server.
App/: the SwiftUI iPhone app and its notification extension.
crates/operalytix-hybrid/: the composite Ed25519 + ML-DSA-87 signature shared by the core and the publisher tool.
core/CRYPTO.md and ARCHITECTURE.md: the full cryptographic specification and threat model.

The licence

Every source file carries an SPDX-License-Identifier: AGPL-3.0-or-later header. Third-party code keeps its own licence; dependencies are limited to licences compatible with the AGPL (MIT, Apache-2.0, BSD, ISC and MPL-2.0), and a release check enforces that.

App Store distribution. The copyright holders grant an additional permission under section 7 of the AGPL to distribute the app through app stores such as the App Store and TestFlight, whose terms would otherwise conflict with the AGPL, as long as the complete source stays available under the AGPL and the app says where.

Running a modified relay for others? Section 13 of the AGPL requires you to offer its source to its users.

Libraries, not home-made cryptography

The cryptography comes from established libraries, including OpenMLS, hpke-rs with libcrux, the fips204 crate for ML-DSA and arti for Tor. Two prebuilt binaries are included as-is: LiveKit WebRTC for calls and Guardian Project’s IPtProxy for Tor bridges. Both are pinned by checksum.

Run a relay

A relay is an untrusted mailbox server: it stores sealed envelopes for up to 14 days and never sees their content. It speaks plain HTTP, so put it behind a TLS reverse proxy or a Tor onion service, then add it in the app under Settings > Relays.

cd relay
docker build -t operalytix-relay .
docker run -d --name operalytix-relay -v relay-data:/data -p 8080:8080 operalytix-relay
curl -sS http://127.0.0.1:8080/healthz    # ok

An onion address on the same server as a public relay does not hide that server. For a relay whose location should stay hidden, use the onion-only setup described in the deployment guide.

Contributing

Every change is reviewed for correctness and security. Please open an issue before large changes. Contributions are accepted under the Developer Certificate of Origin.

Free software, top to bottom.