A Hotline server written in Swift.

A Swift 6, pure-SwiftNIO Hotline-protocol server. Pairs with the Heidrun macOS client (or any classic Hotline 1.x client). Runs on macOS and Linux from the same source.

• Hotline 1.x protocol: chat, plain + threaded news, private messages + private chats, kick, broadcast
• Persistent accounts (SQLite via GRDB) with PBKDF2-SHA256 password hashing
• Admin transactions: createLogin / deleteLogin / openLogin / modifyLogin
• File system: list, info, download, upload, delete, create folder, rename, move, alias
• HTXF transfer side-channel (port + 1) with data-fork resume
• Optional TLS sibling listener pair (encrypts control + transfer end-to-end)
• Tracker UDP registration (Mobius-compatible, 5-min beacon)
• Server banner (transID 212) — JPEG / GIF / BMP / PICT / URL
• Per-file metadata (HFS type/creator + comments) persisted alongside accounts
• Idle-away supervisor — auto-flips the away flag after configurable inactivity
• Server-side chat commands — /version, /who, /topic, /broadcast, /kick, /usershistory, /away, /me, …
• Structured logging via swift-log, graceful shutdown on SIGINT / SIGTERM

From the project's README.

Source code

• Single-file downloads always ship the flattened file object. The server sent a bare data fork unless the Heidrun-only resourceForkSupport flag was negotiated, so classic clients (and Heidrun ≤ 1.4 against classic servers) misread downloads. Fresh downloads, resumes (data-fork remainder + full resource fork) and large files now all frame per the Hotline spec; the flag is a no-op.

• Pins heidrun-protocol 1.1.1 (FILP decode on the client side of the same fix).

• Heidrun Server 1.5.1 September 16, 2026

• Drop boxes and upload folders. Folders named …upload… / …drop box… now carry their classic Hotline roles. viewDropBoxes gates every read and mutation inside a drop box; uploadAnywhere limits uploads to upload folders and drop boxes. Existing accounts with Upload Files but not Upload Anywhere lose upload access to plain folders — see docs/OPERATIONS.md → "Drop boxes and upload folders".

• Docker image: builder is swift:6.3.3-noble; binaries link the Swift stdlib statically and run on plain ubuntu:noble, which is apt-get upgraded at build time.

• Makefile: make build / test / lint / test-linux / up / down / logs, plus make refresh — rebuilds the image without the layer cache so the OS packages inside it are current. Meant for a weekly cron (docs/OPERATIONS.md).

• Pins heidrun-protocol 1.1.0 (adds FolderRole).

• Large-file transfers (> 4 GiB). Single-file and folder downloads/uploads now exceed the old 4 GiB cap when the client negotiates CAPABILITY_LARGE_FILES: 64-bit sizes, the 24-byte HTXF handshake, 64-bit fork headers, and an 8-byte per-item size prefix in folder streams. Legacy clients are unaffected (32-bit, byte-identical).

• UTF-8 text encoding. When a client negotiates CAPABILITY_TEXT_ENCODING, the session uses UTF-8 for all strings (chat, nicknames, file/folder names, comments, news, topic) — so emoji and non-Latin scripts work. The login nickname is decoded UTF-8 when advertised in the login packet; the session flips after the login reply. Non-negotiating clients stay on macOS Roman.

• > 4 GiB framed downloads no longer crash. The download envelope is now streamed in chunks (NIO's ByteBuffer is bounded to 32-bit indices), and fork lengths thread through as UInt64.

• Pins heidrun-protocol 1.0.0 (graduated from the rc series).
• Known limitation: broadcasts are encoded once per the broadcasting session's encoding — fully correct for an all-UTF-8 client population; a mixed population with a legacy (non-UTF-8) client present can mis-render non-ASCII broadcast content. Per-recipient broadcast encoding is a planned follow-up.

• heidrun-admin log --table ACCOUNT + ADMIN columns — the login the user signed on with, and the account's admin flag (true/false). The server now logs login + isAdmin on the per-transaction dispatch line (masked pre-login), so both columns populate on every row.
• -n short alias for --lines on heidrun-admin log (tail-style).

• Connection-shutdown race. stop() now closes live connections and waits for their per-connection session tasks to finish before tearing down the event-loop group. This eliminates the NIO "Cannot schedule tasks on an EventLoop that has already shut down" errors (and the warned-of future forced crash), and makes the SIGTERM shutdown path clean.

Pins heidrun-protocol 1.0.0-rc20. Distribution: Docker + build-from-source.

• heidrun-admin log --date — include the full date (yyyy-MM-dd HH:mm:ss) in log timestamps, in both the line and --table views; without the flag the timestamp is time-of-day only as before.

Pins heidrun-protocol 1.0.0-rc20. Distribution: Docker + build-from-source.

Adds a tabular view for heidrun-admin log.

• heidrun-admin log --table — a fixed-width tabular output mode for the unified log stream, with one column per field (TIME · S · LVL · HOST · NICK · TLS · TRANS · SOCK · TASK · FLDS · ACTION) instead of one free-form line per record. The ACTION column resolves a per-transaction dispatch row's numeric transaction id to a name (a row with TRANS 107 shows login); other rows show their message or audit description. The protocol columns (TRANS/SOCK/TASK/FLDS) ride the debug-level dispatch line — pass --level debug to populate them. Mutually exclusive with --json.

Pins heidrun-protocol 1.0.0-rc20. Distribution: Docker + build-from-source.

Adds a native way to watch server activity without docker logs.

• Operational-log file sink — the server mirrors its operational log (the same lines it prints to stderr / docker logs) into a rotating NDJSON file beside the database (<db_path>.oplog.ndjson), readable off the shared volume. stderr output is unchanged. Size-based rotation (default 10 MB × 5 archives). Config keys operational_log_enabled, operational_log_path, operational_log_max_bytes, operational_log_keep (env HEIDRUN_OP_LOG_*).
• heidrun-admin log — a tail / tail -f for server activity that merges the structured audit events with the operational log into one timestamp-ordered stream. Flags: -f/--follow, --lines, --source audit|op|both, --account, --level, --type, --interval, --op-log-path, --json. Each line surfaces the client host:port and the tls flag as columns.

• The operational-log file sink is on by default, so a fresh start writes a new <db_path>.oplog.ndjson on the data volume. Like docker logs, this file includes client IP addresses and retains them across rotated archives — independent of the audit log's log_ip_addresses setting (which stays off by default). Set operational_log_enabled = false (env HEIDRUN_OP_LOG_ENABLED=off) to disable; heidrun-admin log then streams audit events only. See docs/OPERATIONS.md.

Pins heidrun-protocol 1.0.0-rc20. Distribution: Docker + build-from-source.

• db info now reports the file vault instead of (ephemeral temp). When nothing sets a files root, it falls back to the files directory next to the accounts DB if it exists (e.g. _data/files) — display convenience only; the server's own resolution is unchanged, and no admin command touches the vault.

(rc23 added: --db derives the audit/news siblings, and no-flags config resolution /etc/heidrun/heidrun-admin.toml → ./heidrun-admin.toml → ./_data/heidrun.sqlite.)

Protocol pin unchanged (heidrun-protocol 1.0.0-rc20).

Quality-of-life fixes for running heidrun-admin natively against a bind-mounted deployment:

• --db now derives the audit/news siblings (<db>.audit.sqlite, <db>.news.json), like HEIDRUN_DB_PATH. Previously --db only set the accounts path, so audit/news reported no data even though the files existed.
• Runs with no flags. With no --config/--db (or env), it resolves data in order: /etc/heidrun/heidrun-admin.toml → ./heidrun-admin.toml → ./_data/heidrun.sqlite (the bind-mount convention). A typical deployment can just run sudo heidrun-admin audit …. Ships heidrun-admin.example.toml.

(rc22 already added: drop-to-DB-owner when run as root, the --static-swift-stdlib / libsqlite3-dev build prerequisites, the threaded-news reply fix, and the NIOSSL warning fix.)

Protocol pin unchanged (heidrun-protocol 1.0.0-rc20). Distribution remains Docker + build-from-source.

• Threaded-news create/delete now reply on success (TX 380/381/382/411). The server stayed silent on success, so an await-based client (Heidrun rc26+) hung forever after creating a news folder/category or deleting a bundle/thread. Now they emit a success/error reply like postNewsThread (410) already did, matching the de-facto standard server (mhxd).
• Silence the NIOSSL Sendable warning — the TLS handler is now added via syncOperations (on the channel's event loop) instead of the async addHandler(_:), which warns under stricter swift-nio-ssl versions. Same behavior.
• Zero SwiftLint warnings — cleared pre-existing comma/alignment/data-string warnings and split the oversized ChatCommandsTests.swift.

• Auto-drops to the database owner when run as root. You can now just sudo heidrun-admin … and it acts as the server's user (e.g. UID 1979) — and, crucially, the SQLite -wal/-shm files it creates stay owned by that user instead of root, which would otherwise lock the container out of its own database.

• docs/native-host-admin.md: a Prerequisites callout for the libsqlite3-dev headers, build with --static-swift-stdlib (so the binary runs under sudo -u with a stripped env), and the root auto-drop usage.

Protocol pin unchanged (heidrun-protocol 1.0.0-rc20). Distribution remains Docker + build-from-source.

• heidrun-server 1.0.0 (2026-06-19)
• heidrun-server 1.0.0-rc21 (2026-06-18)
• heidrun-server 1.0.0-rc19 (2026-06-07)