Your own server

What the machine needs

• Linux with an x86-64 processor. The published image is built for one architecture, so an ARM machine will say it cannot pull it.
• 2 GB of memory, and Docker — the installer puts Docker on if it is missing.
• Port 10443 reachable from outside. You can change it with --port, and then people type address:port.

What the one line actually does

It generates its own passwords, brings the database up with the schema the code expects, pulls a finished server image, starts everything, and runs a real client handshake against itself before saying it is done. Nothing is compiled on the machine: the build wants more memory than a small one has, so the image is pulled instead.

It is safe to run twice. Passwords are made once and kept, the data outlives the containers, and database patches are applied only if they have not been already. Running it again is also how you take a newer server image.

A name or an address

Both work. An address is quicker to start with; a name can be pointed at a different machine later, which an address cannot, so it is worth having if the server is meant to outlive the machine it is on now.

Notifications

Notifications go through our relay, push.ice9.app. Your server hands it a sealed notification that contains none of your messages — only the device's token, a count and a blob only that phone can open — and the relay signs it with the keys Apple and Google issue to the app's publisher, which is the one thing a server cannot have of its own. That is the one thing your server needs us for, and it is only for notifications: the relay sees which phone to wake and when, never a name and never a word. The relay is part of the open server; PUSH_RELAY_URL points at one you run yourself.

What it does not do for you

It is your machine, so the backups, the updates and the disk are yours. A new server image is published every time the server changes; running the command again is how you take one. If you would rather that were somebody else's problem, ours is the default for exactly that reason.

The server is open, and you can compile it yourself

The image the installer pulls is a convenience, not the only way in — it exists because compiling the server wants more memory than a small machine has. You do not have to take our word for what is in it. The source is here, and it builds against our fork of the protocol schema, which is where the four encryption methods live:

git clone -b ice9-mls https://github.com/dsfox/proto.git proto
git clone https://github.com/dsfox/teamgram-server.git server
cd server && ./build.sh

That compiles every service, with Go 1.23. Both directories are needed and they have to sit side by side: the server reaches the schema as ../proto.

That is also the whole of what the published image is: run docker build -f server/Dockerfile -t my-ice9-server . from the directory above the two, and point the installer at your own build with | bash -s -- --image my-ice9-server. Nothing else is needed — everything the image carries, down to the database patches and the configuration the services start with, is in those two repositories.

The clients are open too — iOS and Android, both forks of the Telegram apps. A private messenger whose workings are secret is asking for exactly the trust it says you should not have to give.

Read it first

The installer is a shell script and nothing in it is hidden — read it before you pipe it into a shell. That is a good habit whoever wrote it.