https://github.com/johalputt/vayupress
Your whole online presence in one sovereign Go binary — website, blog, and a private PGP mail server (VayuMail: SMTP/IMAP/POP3, DKIM, WKD) with an official mobile app, plus cookieless analytics and one admin panel (VayuOS). SQLite-first, zero telemetry, zero SDKs, strict CSP.
https://github.com/johalputt/vayupress
blog-engine cms content-management-system email-server go golang imap newsletter pgp privacy publishing-platform self-hosted single-binary smtp sovereign sqlite vps webmail zero-telemetry
Last synced: 5 days ago
JSON representation
Your whole online presence in one sovereign Go binary — website, blog, and a private PGP mail server (VayuMail: SMTP/IMAP/POP3, DKIM, WKD) with an official mobile app, plus cookieless analytics and one admin panel (VayuOS). SQLite-first, zero telemetry, zero SDKs, strict CSP.
- Host: GitHub
- URL: https://github.com/johalputt/vayupress
- Owner: johalputt
- License: apache-2.0
- Created: 2026-06-12T09:34:44.000Z (about 1 month ago)
- Default Branch: main
- Last Pushed: 2026-07-12T18:53:23.000Z (8 days ago)
- Last Synced: 2026-07-12T19:13:31.521Z (8 days ago)
- Topics: blog-engine, cms, content-management-system, email-server, go, golang, imap, newsletter, pgp, privacy, publishing-platform, self-hosted, single-binary, smtp, sovereign, sqlite, vps, webmail, zero-telemetry
- Language: Go
- Homepage: https://vayupress.com
- Size: 40.3 MB
- Stars: 3
- Watchers: 1
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- Changelog: CHANGELOG.md
- Contributing: CONTRIBUTING.md
- Funding: .github/FUNDING.yml
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Codeowners: .github/CODEOWNERS
- Security: SECURITY.md
- Governance: GOVERNANCE-CONSTITUTION.md
- Roadmap: docs/ROADMAP-v1.9.md
- Notice: NOTICE
- Maintainers: docs/MAINTAINERS.md
- Agents: AGENTS.md
Awesome Lists containing this project
README
VayuPress
Your whole online presence — website, blog, and private mail — in one sovereign binary.
One VPS. One process. One control panel. Zero telemetry, zero vendor lock-in, zero SDKs.
---
## About
**Vayu** is Sanskrit for *wind* — the invisible force that moves everything and is owned by no one. VayuPress moves your online presence the same way: entirely under your control, seen by no third party.
VayuPress began as a publishing engine. It is now a **complete sovereign platform** — a business **website**, a **blog**, and a private **PGP email server** for your own domain, with an official **mobile mail app**, **privacy-first analytics**, and a single admin console (**VayuOS**) — all compiled into **one Go binary** that runs on a single modest VPS.
Point a domain at one server, run one install command, and you get:
- a **website** at `yourdomain.com`,
- a **blog** at `blog.yourdomain.com`,
- a **mail server with automatic PGP** at `mail.yourdomain.com`,
- **ephemeral, end-to-end-encrypted chat** at `talk.yourdomain.com`,
each with a free Let's Encrypt certificate issued and renewed for you. No SaaS bill, no analytics harvesting, no plugin marketplace, no credentials on someone else's cloud. **You own the content, the mailbox, the data, and the machine.**
> *Own your content. Own your communication. Own your infrastructure.*
---
## What you get
### 🌐 A real website
Serve a genuine business site at your domain — **11 elegant, modern-minimalist templates** (restaurant, café, shop, portfolio, agency, school, clinic, salon, gym, professional firm, hotel), edited entirely from VayuOS with live preview. You choose the hosting topology (website at the root or the blog at the root); an update never changes it for you.
### ✍️ A Ghost-class blog — with a writer people actually enjoy
A best-in-class **block editor** with whole-document **Markdown** and **HTML** modes (lossless round-trips), drag/drop/paste images or any `https` link, tables, toggles, task lists, math, callouts, code, self-hosted audio/video, Mermaid diagrams rendered server-side, a slash-command palette, live preview, autosave, and version-history diffs. The writing surface is tuned to disappear: **typewriter scrolling** keeps your line centered, a **focus-mode spotlight** dims everything but the block you're in, **paste-as-Markdown** turns a whole pasted draft into real blocks, a **live document outline** tracks your headings with click-to-jump, real **footnotes**, image **captions**, block **duplicate**, and full **keyboard block reordering**. Whole-site **themes** restyle every surface (nav, hero, feed, article, footer) with a live Theme Studio. Multi-author bylines, memberships, paywalls, newsletters, threaded comments, and SEO baked in.
### 🛡️ Built-in bot shield & anti-DDoS (VayuShield "Aegis")
An **enterprise-grade, self-learning bot shield so you never need Cloudflare** — built into the same binary, defending in five layers with **zero operator commands**: an admin-sovereignty lane that keeps **Save and refresh working even during a volumetric flood**, a fixed-memory probabilistic fair-shed that catches spoofed botnets without ever touching a client within its fair budget, a reputation brain that jails offenders in minutes and **forgives automatically**, silent-first proof-of-work challenges that self-calibrate so they never bother real browsers, and optional kernel-level `nftables + XDP` offload. Search engines and AI assistants are always allowed; abuse is shed with a polite `503` (never a `4xx`), so **SEO and real users are structurally protected**. Everything is visible and tunable with no restart from the Bot Shield console and its live Aegis layer map. *([architecture →](docs/adr/ADR-0111-vayushield-bot-protection-and-analytics.md))*
### 📧 A sovereign PGP mail server (VayuMail)
Your own mail server for your domain — **SMTP send + receive, IMAP and POP3**, RFC-6376 **DKIM signing**, direct-to-MX delivery with STARTTLS, automatic **MX / SPF / DKIM / DMARC** records with live DNS health checks, per-mailbox quotas, junk filtering, and a full webmail surface. **PGP is native and automatic** (VayuPGP): keypairs are generated per account, private keys are AES-256-GCM encrypted at rest, and your public keys are published via **Web Key Directory (WKD)** so any client can find them. Mail never leaves your server unencrypted to a third party.
### 💬 Ephemeral end-to-end-encrypted chat (VayuTalk)
Real-time private messaging built into the same binary — a **PGP end-to-end-encrypted chat** for your domain that interoperates seamlessly across the **web console and the mobile app over one shared relay**: a message typed on the web reaches the phone and vice-versa, indistinguishable to the server. Every message is encrypted to the recipient's key, relayed through a **bounded in-memory store that never touches disk**, and **read-destroyed** — it vanishes the moment it is read or when its short TTL (5 min – 1 h) elapses. Out-of-band **safety-number verification** (shown identically on web and app) defeats a man-in-the-middle key swap. The relay auto-serves on a dedicated **`talk.yourdomain.com`** subdomain that bypasses any CDN in front of your site, so the long-lived event stream is never buffered or bot-challenged — provisioned automatically by the installer the moment you point that one DNS record. *([architecture →](docs/adr/ADR-0131-vayutalk-ephemeral-messaging.md))*
### 📱 An official mobile app (VayuMail Mobile)
[**johalputt/VayuMail-Mobile**](https://github.com/johalputt/VayuMail-Mobile) — a pure-Go Android app that reads and sends your PGP mail *and* carries VayuTalk chat from your own domain. Connect in **one scan**: the admin's rotating setup QR carries a per-device app password (never your real password, revocable anytime), or auto-detect the whole account from just your email address via VayuPress's first-party autoconfig endpoint. No tracking pixels, no remote content, no telemetry.
### 📊 Privacy-first analytics (VayuAnalytics)
Real product analytics — pageviews, sessions, top pages, referrers, UTM campaigns, custom events, funnels, retention, revenue, and a live visitor panel — stored locally in SQLite. Visitor identity is a **server-side daily-rotating salted hash**: no cookies, no `localStorage`, no IP or User-Agent ever stored, **no consent banner required**, nothing to leak on a database compromise. Visitor country is resolved from an **embedded offline table** — no external GeoIP service, no phone-home.
### 🛠️ One control panel (VayuOS)
Everything above is run from a single, fast, strict-CSP admin at `/os` — dashboard, editor, media library, themes, members, newsletter, mail, **VayuTalk chat**, analytics, **Bot Shield**, SEO, API keys, and one-click **update & encrypted backup**. The dashboard opens on a real **14-day publishing area chart** (server-rendered SVG, hover tooltips, zero JavaScript) and live stat cards; every data table folds into phone-friendly cards on mobile. TOTP two-factor, role-based access, WORM audit log, and an adaptive policy-governed runtime underneath. Built with **HTMX + lightweight hand-written CSS** — no SPA framework, no build step, negligible RAM/CPU.
---
## Quick start
One command stands up the whole stack — website, blog, and PGP mail — on a fresh VPS:
```bash
curl -sSL https://raw.githubusercontent.com/johalputt/vayupress/main/scripts/deploy-vayupress.sh | bash
```
Or clone and deploy manually:
```bash
git clone https://github.com/johalputt/vayupress.git
cd vayupress
sudo ./scripts/deploy-vayupress.sh
```
The installer provisions the binary, systemd service, Nginx, and Let's Encrypt certificates for your website, blog, and mail hostnames. A fresh install auto-creates an `admin@yourdomain` account (random password, saved to a root-only file) and forces a password change on first sign-in — no extra CLI step.
**Add VayuTalk chat (optional, one DNS record).** VayuTalk works on the main domain out of the box; for the seamless real-time relay behind a CDN, point one `A`/`AAAA` record — `talk.yourdomain.com` → your server, **CDN proxy OFF** (the same "DNS-only" mode you use for `mail.`) — and re-run the installer (or let the next update run it). It adds the subdomain's TLS certificate, writes its Nginx vhost, and advertises it to the app automatically. Nothing else to configure. *(See [docs/TROUBLESHOOTING.md](docs/TROUBLESHOOTING.md) → "VayuTalk".)*
Runs comfortably on a single **8 GB RAM / 4 vCPU / 50 GB NVMe** VPS.
---
## Why VayuPress
| | VayuPress | Typical stack |
|---|---|---|
| **What it replaces** | Website builder **+** blog **+** mail provider **+** analytics **+** admin | Four or five separate SaaS bills |
| **Where your data lives** | Your VPS, your SQLite file | Vendor clouds you don't control |
| **Telemetry** | None — verifiable, it's open source | "Anonymized analytics" |
| **Mail** | Your own server, PGP automatic | Google/Microsoft reads the metadata |
| **Private messaging** | Built-in, E2E-encrypted, ephemeral (VayuTalk) | A separate Signal/Slack account & server |
| **Tracking of readers** | Cookieless, no PII, no consent banner | Cookies + third-party pixels |
| **Bot & DDoS protection** | Built-in, self-learning (VayuShield Aegis) | A separate Cloudflare/WAF subscription |
| **Dependencies** | One Go binary + SQLite + Nginx | Node, databases, Redis, queues, SDKs |
| **Extensibility** | Sandboxed, capability-gated plugins | Marketplace plugins with full access |
| **Lock-in** | Open standards, plain export | Proprietary formats, export friction |
---
## One binary, by design
VayuPress is a single Go binary and a single SQLite database. There is no second service to install, secure, or keep alive — search, comments, analytics, mail, and PGP all run in-process.
```text
Internet ──HTTPS──▶ Nginx (TLS, static, CSP)
│ 127.0.0.1:8080
┌─────────────────────────────▼──────────────────────────────┐
│ VayuPress (one Go binary) │
│ │
│ VayuShield Aegis (L0 lane · L2 fair-shed · L5 brain) │
│ Website · Blog · Block editor · Themes · Members │
│ VayuMail (SMTP/IMAP/POP3 · DKIM · MX/SPF/DMARC) │
│ VayuTalk (ephemeral E2E chat · SSE relay · read-once) │
│ VayuPGP (keys · WKD) VayuFind (search) Analytics │
│ VayuOS control panel Newsletter Media API │
│ │
│ ── Platform kernel (immutable) ── │
│ signing · migrations · outbox · policy · modes · audit │
│ │
│ SQLite (WAL mode) │
└─────────────────────────────────────────────────────────────┘
```
Under the hood: an **immutable platform kernel** (Ed25519 article signing, checksum-verified migrations, transactional event outbox, WORM audit log, a policy engine and six adaptive system modes), an async SQLite write queue with dead-letter replay, sandboxed out-of-process plugins with seccomp + capability enforcement, and full observability (structured logs, tracing, SLO error budgets). Architecture and every decision are recorded in [`docs/`](docs/) and the [ADR registry](docs/adr/).
---
## Showcase
### Website & blog
*Public homepage — article grid with tag filtering, dark/light toggle, zero-telemetry footer. Styled entirely from your own origin (strict `style-src 'self'` CSP).*
*A rendered article — JSON-LD schema, author/date meta, tag strip, reading time, and zero third-party requests.*
### VayuOS — the single control panel
*The dashboard (`/os`) — grouped sidebar, stat cards, publishing-trend sparkline, activity feed, and a `⌘K` command palette.*
*The block editor — typed-block document rendered server-side through escape + bluemonday, slash-command palette, autosave, live preview, and inline version-history diff.*
*Theme Studio (`/os/theme`) — a preset gallery and design-token editor with instant live preview, compiled to one sovereign stylesheet served from your own origin.*
*VayuAnalytics — cookieless, no-PII product analytics computed entirely from your local SQLite database.*
### 🛡️ VayuShield — the built-in bot shield
*The Bot Shield console (`/os/shield`) — a live Aegis layer map (L0 sovereignty lane · L2 fair-shed · L4 challenges · L5 reputation brain · L1 kernel offload), protection toggles that apply with no restart, learned-signature review queue, and cookieless engagement analytics. Self-learning and self-healing: it protects availability automatically, never blocks a real reader or a search/AI crawler, and needs no Cloudflare.*
More of VayuOS — posts, media, SEO, security, and the operator control plane
| | |
|---|---|
|  |  |
| *Post manager with live status pills* | *Content-addressed media library* |
|  |  |
| *SEO readiness dashboard* | *Security & PGP surface (admin-only)* |
|  |  |
| *Strict-CSP, self-hosted sign-in* | *Branded passwordless member signup* |
The adaptive-governance runtime is fully inspectable from inside VayuOS — system modes, the policy provenance inspector, a live runtime-topology graph, the dead-letter replay explorer, the fault manager, and the ADR registry.
| | |
|---|---|
|  |  |
|  |  |
> Screenshots are regenerated from a live instance by the [screenshots CI workflow](.github/workflows/screenshots.yml).
---
## Security & sovereignty
- **Zero telemetry, zero third-party reader requests.** Strict CSP (no `unsafe-eval`, no `unsafe-inline`, per-request nonces); all assets served same-origin. No CDNs.
- **Encrypted at rest.** PGP private keys and stored third-party secrets are AES-256-GCM encrypted; operator backups are a single AES-256-GCM + Argon2id archive of everything (DB, settings, media, mailboxes, keys).
- **Sandboxed extensibility.** Out-of-process plugins run under seccomp + namespace isolation with deny-by-default capabilities.
- **Governed by construction.** A machine-enforced [Constitution](GOVERNANCE-CONSTITUTION.md), an [Ethical AI Charter](ETHICS.md) (no training on user data, no telemetry), signed releases, and a WORM audit log. AI assistance is strictly opt-in and local-only (Ollama) — nothing leaves your server.
---
## Documentation
- **[CHANGELOG.md](CHANGELOG.md)** — every release and what changed, version by version.
- **[docs/adr/](docs/adr/)** — Architecture Decision Records: every design decision, recorded.
- **[GOVERNANCE-CONSTITUTION.md](GOVERNANCE-CONSTITUTION.md)** — the binding rules, mechanically enforced by CI.
- **[ETHICS.md](ETHICS.md)** — the Ethical AI Charter.
- **[VayuMail-Mobile](https://github.com/johalputt/VayuMail-Mobile)** — the official mobile mail app.
## License
Apache License 2.0 — see [LICENSE](LICENSE).