Lonewolf 0.3 Adds Federation to Its Rust XMPP Server, With Certificate-Only Peers

Lonewolf, an XMPP chat server written in Rust, can now exchange messages with other XMPP servers. Version 0.3.0, released Nov. 13 by a maintainer who goes by ortuman on GitHub, adds federation, which the release notes call "the big one in this release."

XMPP is an open chat protocol in which each server hosts its own users and servers pass messages between each other. The notes describe federation as new in 0.3.0, so earlier versions could not do it. The project is Apache-2.0 licensed and the repository shows 76 stars.

What federation in 0.3.0 accepts and rejects

Users can exchange messages, presence, IQs (request-and-response stanzas) and roster subscriptions with users on other servers. Federation is on by default when a host has a certificate and a public DNS name.

Peers are authenticated by certificate only. The other server needs a trusted certificate and support for SASL EXTERNAL, a login method that relies on that certificate. Server Dialback, the older XEP-0220 method, is not supported, so a server that cannot present a trusted certificate cannot federate with Lonewolf.

Addition in 0.3.0	Default	Detail from the notes
Federation	On with certificate and public DNS name	Certificate-only peer authentication
Direct TLS	New dedicated listeners	Outbound federation finds STARTTLS and direct TLS endpoints
XEP-0049 private XML storage	On	Holds private settings and legacy bookmarks
XEP-0092 software version	On	Hides the operating system unless enabled
SCRAM-SHA-512 and -PLUS	Off	Opt-in

Shared connections between servers

The notes also list XEP-0288, which lets two servers use one connection for both directions when the other side supports it. The XEP-0288 specification, version 1.0.1, last updated Oct. 17, 2016 and written by Philipp Hancke and Dave Cridland, explains the gap it fills. RFC 3920 required two TCP connections between servers, one per direction. RFC 6120 allows bidirectional use but does not define how to signal it.

Lonewolf also implements XEP-0478, under which servers exchange stanza size and idle limits up front.

The caveats the release notes print

The notes say "Lonewolf is still pre-1.0 and runs as a single node." Four other items affect anyone upgrading:

• Revocation lists, which record certificates a certificate authority has withdrawn, are fetched over plain HTTP. If one cannot be downloaded, "the connection goes ahead anyway." Setting s2s.tls.fetch_crls = false or pointing s2s.tls.crls_path at a local file changes that.
• SCRAM-SHA-512 comes from an expired Internet-Draft, not an RFC, and is not registered with IANA.
• Rollback to 0.2.0 is hard: "new accounts and password changes now store credentials that v0.2.0 can't read."
• The benchmark tool is renamed from lonewolf-bench to lonewolfbench, which breaks scripts that call the old name.

The notes list no bug fixes. The README gives no benchmark figures, though it describes the server as "frugal with memory and CPU."

Who wrote it, and what comes next

The README says most of the code, tests and docs were written with AI coding agents, with the maintainer setting the design and reviewing changes. Storage is an embedded redb database by default, with PostgreSQL planned for step 3 of a four-step roadmap.

Hacker News readers pushed the release to 132 points, but 76 stars is not adoption. Two other open-source projects on the same Hacker News list this week were Makepad's Relax and the Coway air purifier integration.

Roadmap step 1 covers external components, group chats, file upload and basic desktop messaging. The README gives no date for it.