MeshChatX

产品介绍

MeshChatX 是基于 Reticulum 的网状通信客户端，提供浏览器界面、消息、通话及相关工具。

主要功能

Reticulum 网状通信与联系人管理
浏览器界面的消息、通话和工具
持久化的身份、TLS 和本地通信数据

访问说明

安装后通过 https://<服务器 IP>:<端口> 访问，实际端口以 PANEL_APP_PORT_HTTPS 为准。上游默认生成自签名证书，首次访问会出现浏览器证书提示；生产环境应使用可信 TLS 终端并限制网络暴露范围。

应用固定启用上游认证。首次访问时在 Web UI 中设置强密码，之后使用该密码登录。首次部署时，先仅从受信任网络完成此设置，再开启 1Panel 的端口外部访问。请只向受信任的用户开放服务；上游明确不建议将其直接暴露到公共互联网。

数据持久化

APP_DATA_DIR 挂载到容器的 /config，保存 Reticulum 身份、TLS 证书、认证配置、消息和其他应用数据。该路径必须位于应用版本目录内（默认 ./data）；安装与升级脚本会拒绝绝对路径及目录外路径，避免误改宿主机文件权限。脚本将目录设置为镜像要求的 UID/GID 1000:1000。卸载不会删除绑定目录中的用户数据，升级、迁移或卸载前请备份该目录。

安全说明

容器显式使用上游的非 root UID/GID 1000:1000，根文件系统只读，丢弃全部 Linux capabilities，并启用 no-new-privileges。仅 /config 数据卷及上游要求的 /tmp、/home/meshchat tmpfs 可写。
2026-07-28 对固定镜像的 Trivy 扫描未发现 Critical 或 High 漏洞；仍应在后续镜像更新前重新扫描。
插件和通信数据属于用户信任边界。仅安装可信插件，并保护包含身份和消息数据的 /config 备份。

Introduction

MeshChatX is a Reticulum mesh communications client with a browser interface for messaging, calls, and related tools.

Features

Reticulum mesh communications and contact management
Browser-based messaging, calls, and tools
Persistent identity, TLS, and local communications data

Usage Notes

Access the service at https://<server-ip>:<port>. The upstream self-signed certificate triggers a browser warning on first access; use a trusted TLS endpoint and restrict network exposure for production use.
Upstream authentication is enabled by default. Set a strong password in the Web UI from a trusted network before enabling 1Panel external port access, then use it for later sign-in. Do not expose the service directly to the public internet.
APP_DATA_DIR persists Reticulum identity, TLS material, authentication settings, messages, and other application data. It must remain relative to the application version directory (default ./data); absolute and outside paths are rejected. The initialization script assigns it to UID/GID 1000:1000.
The container explicitly runs as upstream UID/GID 1000:1000, uses a read-only root filesystem, drops all Linux capabilities, and enables no-new-privileges. Only /config and the upstream-required /tmp and /home/meshchat tmpfs mounts are writable.

References

Project: https://github.com/Quad4-Software/MeshChatX
Docker deployment: https://github.com/Quad4-Software/MeshChatX#docker
Security architecture: https://github.com/Quad4-Software/MeshChatX/blob/master/docs/en/architecture.md
License: https://github.com/Quad4-Software/MeshChatX/blob/master/LICENSE (0BSD and MIT)