Problem
Most chat products begin with account systems, social graphs, and broad collaboration features. For a few people sharing a quiet space over time, that machinery can become the distraction.
VA-11 Chat starts with a smaller question: how can a self-hosted, understandable system provide channel-isolated real-time conversation while retaining the access control and administration that matter?
Role
Creator / Maintainer.
System
- Single-process architecture: one long-running Node.js process serves the Express API, static frontend, and native WebSocket connections.
- Channel isolation: an administrator creates channels and users; visitors sign in with channel credentials, and messages remain within their channel.
- Local persistence: channel configuration and the latest 100 messages live in JSON and JSONL files, without a database or ORM.
- At-rest message encryption: AES-256-GCM protects messages before they are written to disk, with separate secrets for signed cookies and message encryption.
- Lightweight safeguards: login and message rate limits, secure production cookies, and explicit single-instance deployment boundaries.
- Deliberately simple frontend: Vite and React power responsive login, chat, and administration views without a component library.
Impact
The project compresses real-time communication, authentication, persistence, and deployment into a small, reviewable codebase. Vitest integration tests, Docker Compose, and a GitHub Actions workflow make it practical for small self-hosted, single-instance communities while keeping the system's security boundaries visible.
Deployment Scope
VA-11 Chat is designed for small, access-controlled, self-hosted groups. Anonymous communication, end-to-end encryption, and public-service operation are outside its intended scope. Anyone running it as a public service should assess the registration, content-governance, and personal-data requirements that apply in their jurisdiction.
Why It Matters
Simplicity does not mean ignoring the hard parts. VA-11 Chat gives each layer a reason to exist: WebSockets for live conversation, encrypted files for retained history, and a single process because horizontal scale is outside the product's purpose. It is an exercise in product restraint and understandable software.