--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
docs/en/identity-and-security.md c33fb39ec9b7a217f7b3d2e461cdfd3d31db74d2 (c33fb39e) Text, 4.09 KB
Tc9d1d9# Identities, privacy, and security
MeshChatX separates cryptographic identities, network security, and optional privacy controls. This page summarises how they interact.
Tc9d1d9## Identities
Each identity is a Reticulum key pair with its own:
Tff7b72- SQLite database and LXMF router directory
Tff7b72- Settings in the Ta5d6ff`config` table via Ta5d6ff`ConfigManager`
Tff7b72- Storage path under Ta5d6ff`storage/identities/<identity_hash>/`
Create, import, or switch identities from **Identities**. Only one identity is active in the UI at a time. Switching runs a teardown path so routers and managers do not leak state.
Shared resources include the Reticulum process and interface configuration in Ta5d6ff`~/.reticulum` unless you override paths.
Tc9d1d9## Announces
MeshChatX tracks announces for aspects such as:
| Aspect | Meaning |
| ------------------- | --------------------------------- |
| Ta5d6ff`lxmf.delivery` | Peer accepts LXMF messages |
| Ta5d6ff`lxst.telephony` | Peer accepts LXST calls |
| Ta5d6ff`lxmf.propagation` | Propagation node |
| Ta5d6ff`nomadnetwork.node` | NomadNet page server |
| Ta5d6ff`rrc.hub` | Relay chat hub (when RRC enabled) |
Announce records store signal metadata and parsed app data for display names and icons.
Tc9d1d9## Web UI authentication
Optional HTTP basic authentication is enabled with Ta5d6ff`--auth` or Ta5d6ff`MESHCHAT_AUTH=true`. Sessions use encrypted cookies. Mutating API requests require CSRF tokens.
Access attempts are logged. Repeated failures can trigger lockout when auth is enabled.
Reset a forgotten password with Ta5d6ff`--reset-password` or Ta5d6ff`MESHCHAT_RESET_PASSWORD=true`, then set a new password in the UI.
Tc9d1d9## Transport security
Tff7b72- HTTPS and WSS are on by default.
Tff7b72- Self-signed certificates are generated per identity when custom PEM files are missing.
Tff7b72- Pass Ta5d6ff`--ssl-cert` and Ta5d6ff`--ssl-key` for managed certificates.
Tff7b72- Use Ta5d6ff`--no-https` only on trusted loopback setups.
Electron loads the UI from the local HTTPS origin served by the embedded backend.
Tc9d1d9## IP allowlisting
Ta5d6ff`app_security_settings` can restrict which client IPs may use the web UI. Combine with auth when exposing the service beyond localhost.
Tc9d1d9## Privacy mode
**Privacy mode** blocks outbound HTTP from MeshChatX features that would otherwise call the public internet. Translation and similar tools respect this flag.
Privacy mode does not disable Reticulum mesh traffic. It limits clearnet fetches from the app itself.
Tc9d1d9## Linux sandboxing
Optional Landlock sandboxing on Linux restricts filesystem access for the backend. See **Linux sandboxing** in Platform guides for Firejail and Bubblewrap examples.
Tc9d1d9## Blocking and filtering
Use **Blocked** for specific destination hashes. Combine with sieve filters, message blocklists, and LXMF stamp policies described in **LXMF messaging**.
Tc9d1d9## Data backup
Database backups land in Ta5d6ff`database-backups/`. Export snapshots from **About** or the API. Electron crash recovery can offer restore when integrity checks fail.
CLI restore example:
Ta5d6ff```Ta5d6ffbash
meshchatx --restore-db /path/to/backup.zip
Ta5d6ff```
Tc9d1d9## Integrity checks
Startup integrity verification runs in packaged Electron builds and can be triggered from the backend. Failed checks surface recovery options instead of silently corrupting data.
Tc9d1d9## Safe deployment patterns
Ta5d6ff```
Recommended for most users
|
v
Bind 127.0.0.1, use HTTPS, enable auth if others use the same host
|
v
Add interfaces only for meshes you trust
|
v
Keep backups and test restore on upgrades
```
Avoid exposing port 8000 directly to the internet without a reverse proxy, strong auth, and network-level filtering. MeshChatX is designed as a personal or small-team operator console, not a multi-tenant public website.
Tc9d1d9## Multi-user hosts
On shared computers, use separate OS user accounts or separate Ta5d6ff`--storage-dir` values so SQLite databases and identity files do not overlap.
Tc9d1d9## See also
Tff7b72- **Architecture and design** for session and API details
Tff7b72- **Installation and setup** for CLI security flags
Tff7b72- Reticulum manual cryptography chapters for identity math
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────