Stoat

What it's good for#

If your friends or your gaming group live on Discord, Stoat will feel familiar straight away. You make servers, each with text channels and voice channels, give people roles with different permissions, and chat, share pictures and jump into a voice call. The difference is that it's yours: no adverts, no one else reading along, and nobody can close your server but you. You may know it by its earlier name, Revolt.

For a work-style team chat, Rocket.Chat or Mattermost suit better. Stoat is for hanging out.

Signing in#

Upstream, the first person to register on a new Stoat becomes its owner, with no email check and nothing to slow anyone down. LibrePortal closes that gap: as soon as Stoat's API answers during the install, it registers the owner account itself.

• Email: admin@stoat.local. It's only a login name; nothing is ever sent to it.
• Handle: administrator (Stoat refuses admin).
• Password: in the Login Details shown when the install finished; press Welcome on the app's page to see it again.

Open Stoat with the Web Interface button and sign in. The first start takes a few minutes: Stoat is sixteen containers, which start in order, and its API keeps restarting until its database and message queue are both ready.

Adding people#

Registration is invite-only on LibrePortal (CFG_STOAT_INVITE_ONLY=true), so strangers who find your Stoat can't make accounts. You add people from the Tools tab instead:

The email doesn't have to be real, because Stoat sends no mail here, but a real one makes it easier for people to remember what they signed in with.

Reset User Password, List Users, Disable User Account (which stops someone signing in but keeps their account and messages) and Enable User Account cover the rest.

Voice and video#

Voice and video need two things.

HTTPS. Browsers only allow a page to use your microphone and camera when it's served over HTTPS. Text chat, channels, roles and uploads all work on a plain http://192.168.1.50:port address; calls don't, and the VPN doesn't change that, because the browser checks the address. Either of LibrePortal's HTTPS choices fixes it.

The call ports. Calls travel directly between Stoat's call server and each person, not through the web page. They try UDP ports 50000 to 50100 first, and fall back to TCP port 7881, which is public and open. LibrePortal publishes the UDP range but doesn't open it in the firewall, so from outside your network calls use the slower TCP fallback until you add one rule:

sudo ufw allow 50000:50100/udp

LibrePortal's firewall rebuild only adds the rules for the ports it knows about and doesn't clear the others, so a rule you add yourself stays.

To check: on a rooted install LibrePortal manages the firewall with ufw-docker; check whether a plain ufw allow actually opens a Docker-published UDP range there, or whether it needs a ufw-docker/route rule instead

Good to know#

• Its address is built in at install. Stoat's web app is made with its own address inside it: https://stoat.example.com with a domain and Traefik, http://192.168.1.50:port without. If you add a domain later, press Update Configuration on its Config tab so it's rebuilt with the new one.
• It can't share the server with Screego. Screego's relay ports are UDP 50000 to 50019, inside Stoat's call range, so only one of the two can run on a server.
• Phone and desktop apps. Stoat's web page works in a phone's browser. To check: check whether Stoat's phone and desktop apps can be pointed at a self-hosted server, and how
• It isn't behind Authelia, and shouldn't be: Stoat's own apps talk to its API, and an extra sign-in page in front would stop them.
• Backups include everything: the database, uploaded files and its secret keys. The key that encrypts uploaded files is made once at the first install and never replaced, because without it every file ever uploaded would be unreadable. Keep your backups safe for the same reason.
• Updates are paused for now. Stoat relies on two small helper images (MinIO) that its makers have stopped publishing. Until those are replaced, LibrePortal can't update Stoat: it's set to Manual, and both Update and Upgrade would fail at the download. Nothing is lost in the meantime; Stoat keeps running on the version you installed. To check: Stoat is manual because minio/minio and minio/mc are gone from Docker Hub (update-backup-audit F18); once its compose moves to published images, document its normal update path (lockstep parts, Upgrade for a new release)
• One per server. Its call server needs fixed port numbers.