Skip to content
CoveCove

Architecture

Cove architectureWeb, desktop and Android clients connect over HTTPS, WebSocket and UDP to one Cove server, which stores data in an encrypted BadgerDB database and on disk.Web clientReact, served as static filesDesktop appWails shell (Windows, macOS, Linux)Android appKotlin and Jetpack ComposeCove serverone Go binary, configured by config.tomlREST APIroutes, RBAC, rate limitsWebSocket hubevents, presence, signalingWebRTC SFUcalls and screen shareSTUN / TURNembedded NAT traversalAuthsessions, CSRF, tokensStorerepository layerCryptoArgon2id, AES-256-GCMRaw UDP voiceair-gapped mode onlyMessages arrive as ciphertext; the server wraps and distributes channel keys.BadgerDBencrypted at rest (data/db)Uploadsfiles on disk (data/uploads)
HTTPS and WebSocketUDP media (WebRTC) and raw UDP voice

Server components

Section titled “Server components”
  • REST API on http_port (default 4000), using the standard library ServeMux. Every route is wrapped by an access tier: public, authenticated, channel member, admin or owner.
  • WebSocket hub delivers messages and presence in real time and carries call signaling. It applies the same membership checks as the REST API.
  • WebRTC SFU (voice.mode = "webrtc", the default) forwards audio, video and screen shares between participants. Media is encrypted with DTLS-SRTP. An embedded STUN/TURN relay handles NAT traversal.
  • Raw UDP router (voice.mode = "raw_udp") is an unencrypted, audio-only router for isolated LANs. No video or screen sharing.
  • BadgerDB stores everything. The database is encrypted with a data key that is itself wrapped by a key derived from your master password.

Clients

Section titled “Clients”

All clients talk to the same API. Web sessions use an httpOnly cove_session cookie with a double-submit CSRF token; the desktop app uses a Bearer token. The web client is a static single-page app, so it can be served by nginx, Caddy or any file host.

What lives where

Section titled “What lives where”
Data Location Protection
Messages and metadata BadgerDB Encrypted at rest; message bodies are also ciphertext from the client
Channel keys BadgerDB Wrapped by the key-encryption key
Uploaded files data/ Stored on local disk
Whisper content Memory only Never persisted