Reference

Self-hosting

The signaling server is a single Rust (Axum/Tokio) binary backed by Redis. Run it on a $5 VPS, point the SDK at it, and the entire realtime stack is yours: no usage caps, no vendor.

Requirements

• Redis (or a Redis-compatible store): default redis://127.0.0.1:6379, override with --redis_url.
• A container runtime (Podman or Docker), or a Rust toolchain to build from source.
• For production: a domain with TLS (either terminate at the server with --sslkey/--sslcert, or put it behind a reverse proxy).
• For strict-NAT users: a TURN server such as coturn (below).

Run with Podman / Docker

# Redis
podman run -d --name dendri-redis -p 6379:6379 docker.io/redis:7

# Signaling server
podman run -d --name dendri \
  -p 9876:9876 \
  ghcr.io/afterrealism/dendri-server:latest \
  --host 0.0.0.0 --port 9876 \
  --redis_url redis://host.containers.internal:6379 \
  --enable_relay

A production-grade Podman Quadlet stack (server + Redis + coturn + website, with systemd units) lives in dendri-infrastructure, including Terraform for VM provisioning.

Run from source

git clone https://github.com/afterrealism/dendri-server
cd dendri-server
cargo build --release

# Local development
cargo run -- --host 127.0.0.1 --port 9876 --enable_relay --allow_discovery

# With TLS terminated by the server itself
cargo run -- --host 0.0.0.0 --port 443 \
  --sslkey /path/to/key.pem --sslcert /path/to/cert.pem \
  --enable_relay

Key configuration flags

Every flag can also be set via environment variable; the full reference is in the server repo.

HTTP endpoints

Per-tenant JWT room ACLs (hosted)

On the hosted tier each tenant can carry its own jwt_secret, so your backend mints short-lived HS256 tokens that gate which rooms your end-users may join. The client passes the token as jwt next to apiKey — on the WebSocket, SSE, and polling transports alike.

Precedence when a connection's API key resolves to a tenant:

1. The tenant's jwt_secret, when set — the JWT must verify against it.
2. Otherwise the global --jwt_secret, when set.
3. Otherwise JWT auth is not enforced for that connection.

Tokens must be HS256 with exp. The rooms claim (array of room IDs) gates ROOM-JOIN — absent means all rooms. The optional tid claim must equal the tenant's id when present.

import jwt from 'jsonwebtoken';

function boardToken(user, roomIds) {
  return jwt.sign(
    { sub: user.id, tid: 't_xxxxxxxxxxxx', rooms: roomIds },
    process.env.DENDRI_TENANT_JWT_SECRET,
    { algorithm: 'HS256', expiresIn: '5m' }
  );
}

Provision the secret via the admin API (--admin_token): set jwt_secret on POST /admin/tenants (returned once, like the API key), or rotate later with POST /admin/tenants/:id/rotate-jwt-secret. GET responses expose only has_jwt_secret — never the secret itself.

TURN with coturn

Without TURN, peers behind symmetric NAT (many mobile carriers, some offices) can't establish direct connections. Run coturn next to the server with a shared HMAC secret:

listening-port=3478
fingerprint
use-auth-secret
static-auth-secret=YOUR_SHARED_SECRET
realm=turn.example.com

--turn_secret YOUR_SHARED_SECRET \
--turn_servers turn:turn.example.com:3478

Clients then opt in with fetchTurnCredentials: true: the SDK fetches short-lived credentials from /turn-credentials before connecting, so no static TURN passwords ever ship in your frontend bundle.

Pointing the SDK at your server

const store = createDendriStore({
	url: "wss://signal.example.com", // your domain
	fetchTurnCredentials: true,
	enableRelay: true,
	signalingTransport: "auto",
});

Scaling and operations

• State lives in Redis, so the server process is restartable without dropping room state; clients auto-reconnect and re-send membership.
• Monitoring: scrape /metrics with Prometheus; probe /health from your load balancer.
• Sizing: signaling is tiny: handshakes and heartbeats only. The routing hot path costs nanoseconds in-process (criterion: ~56 ns peer lookup, ~44 ns fan-out to a 50-peer room), so the default --concurrent_limit 10000 is realistic on a small VM — the data path is peer-to-peer, and rooms cap at --max_room_size 50 by default. TURN bandwidth (when used) is the real cost driver.
• Reverse proxy: if you terminate TLS at nginx/Caddy, make sure WebSocket upgrade headers are forwarded and idle timeouts exceed the 60 s heartbeat.

Licensing

Running the unmodified server for your own product is fine and requires nothing beyond keeping the license notice. If you need to modify the server and keep those changes private while offering it as a service, a commercial license is available from Afterrealism: get in touch.

Deployment questions? Open an issue on GitHub.