He released a binary. A default install still calls home.

On 12 October 2026 Alex Gleason posted Armada Stack: one Rust binary, a curl command, and a 101-second video. The binary is new. A self-host guide had been on the blog since 30 July.

The post

Reddit account gleasonator13, flair "Armada dev," posted "Self-Hosting Armada" at 21:49:01 UTC on 12 October 2026. The body says he has "just released" Armada Stack, "a single Rust binary you can install on your server to run a complete self-hosted Armada." The list is: "Your own copy of the Armada client hosted on your domain," a built-in Nostr relay, a Blossom server, an audio and video server, a web-push gateway, HTTPS with certificate renewal, and Tor. Then:

Set up a fresh VPS, point your domain at it, and run the script:

curl -fsSL https://armada.buzz/install.sh | sudo sh

This is a full-stack implementation of the Concord Protocol running entirely on your server. It's a small version of what armada.buzz uses, tailored specifically towards self-hosting.

The same hour, under "So does this mean I can run the entire armada server with no connection to the devs complete independently?", he answered "Yep."

The repository's own history starts earlier than the post. On the GitHub mirror, checked 14 October 2026, all 140 commits on main are authored Alex Gleason. The oldest is 2 October 2026, 03:15:30 UTC, "Scaffold armada: web service serving Armada's nsite, relay and Blossom stubs." The newest is 13 October, 15:20:51 UTC, "Release 0.6.0." GitHub created that mirror on 13 October, the day after the post. The README's canonical remote is nostr://npub10qdp2fc9ta6vraczxrcs8prqnv69fru2k6s2dj48gqjcylulmtjsg9arpj/git.shakespeare.diy/armada-stack, and releases are signed by the Team Soapbox pubkey. This count is the stack repository. The client repository is a different history, and Chad Curtis is still the largest author there as of the 7 October census.

The video

The post attaches a 101-second, 1920 by 1080 video with audio, v.redd.it/s3f6uxpzw3vh1, last modified 12 October 2026, 21:49:24 GMT. Frames read one a second:

• "Every community you've ever loved lives on someone else's server."
• "They can read it."
• "They can sell it."
• "They can switch it off."
• "What if there was no off switch?"
• "No center." "No owner." "No single point of failure."
• "Your community lives on many servers at once."
• "Take one down." "The fleet sails on."
• "armada stack. Everything your community needs. One binary."
• A terminal titled "a fresh linux box."
• "A Nostr relay. Most of what it holds is encrypted noise."
• "Files are encrypted on your device. The server can't look inside."
• "Voice and video, through your own server."
• "Notifications for DMs and channels."
• "Your whole stack on a .onion address. On by default."
• "Certificates fetched and renewed for you."
• "No cookies. No IP logs. Nothing to hand over."
• "NO DATABASE." "NO PROXY."
• "Every server is a ship." "Every ship makes the fleet stronger." "No one can sink an armada."
• "Launch yours." Then the same curl command.

A comment under the post, from u/VahsteTheNomad, transcribes the end line as "you can't sink an Armada." The frame says "No one can sink an armada."

The terminal in the video prints "installed armada 0.4.1 at /usr/local/bin/armada," "downloaded armada-x86_64 and checked its sha256," "created the armada user," and an onion drawn with an ellipsis in the middle, ar7mz4kqyl...q2xd.onion. The 0.4.1 installer, tagged 6 October 2026, does say installed armada $version at $BIN with that path, and "wrote $CONFIG; every other setting has a default." The picture drops the second half of the config line. Release 0.5.1 is 9 October. The post is 12 October. The script at https://armada.buzz/install.sh on 14 October is the 0.6.0 shell script, byte for byte the copy in the GitHub repository. Changelog 0.6.0, committed 13 October, says install.sh "no longer installs the binary anywhere else" and adds the package repository at pkg.soapbox.pub. The video shows a 0.4.1 install. The command in the same video now runs a different script.

Under a comment calling the video AI and the release a diversion, Gleason posted a screenshot of the profile screen, twelve illustrated avatars, and wrote "9 artists have been paid so far! I'm still working on the last 3." The image shows the avatars. It does not show a payment.

The guide was already there

Derek Ross's How to Self-host Armada is dated 30 July 2026. It tells an operator to run the web app, point it at relays, and clone a voice broker. A fetch of the live URL on 9 October 2026 still had that post, including "There is no iPhone app yet" and "with no asterisk on the calls." Wayback captured the same sentences on 13 September 2026.

Fetched again on 14 October, that URL is a different post. Title still "How to Self-host Armada." Date 12 October 2026. Byline Alex Gleason. Closing line: "Updated October 12, 2026 with new instructions for Armada Stack. Thanks to Derek Ross for the original guide." The new text has no iPhone sentence and no asterisk sentence. The 30 July quotes on the other pages are quotes from the guide as fetched. They are not quotes from the page that URL serves now.

What a default install does

The blog's own later section is more careful than the Reddit answer. It says "Your own are used by default, plus public ones for redundancy. Use at least 3 of each," and it lists "Turn off frontend auto-updates" as an edit. INSTALL.md says the app "uses this server's relay and Blossom server alongside Armada's public ones," and that armada "checks the relays for new versions of the web app and deploys them on its own." The post's "entirely on your server," and the "Yep," skip the edit those two documents describe.

src/web/env.rs builds window.ENV for a public host. The unit test on a default config expects exactly:

• RELAYS = wss://armada.example.com,wss://relay.ditto.pub,wss://relay.dreamith.to
• BLOSSOM_SERVERS = https://armada.example.com/,https://blossom.ditto.pub/,https://blossom.dreamith.to/,https://blossom.primal.net/

The comment above the relay list says the two public relays "keep a copy of those off this server." Emptying the list "brings back Armada's own default." Setting RELAYS to this server alone, the example config says, means "losing this server loses every user's list of communities, and search finds nothing: this relay has no NIP-50 search." The 8 October privacy policy says Soapbox operates relay.ditto.pub and blossom.ditto.pub.

The web app is not compiled into the binary. config.rs names the default, "Armada's official nsite, published by Team Soapbox," and the naddr is naddr1qvzqqqyf8qpzq7q6z5ns2hm5c8msyv83qwzxpxe52j8c4d4q5m92wsp9sflelkh9qqrxzundv9jxz0nw9gl. On 14 October the homepage at armada.buzz sent that same value in x-nsite-addr. auto_update defaults to true. The worker fetches the manifest at startup, again every resync_interval of 600 seconds, and subscribes while auto-update is on. The relays it asks are wss://relay.ditto.pub and wss://relay.dreamith.to. Turning auto-update off keeps the first version that landed. The README's line for the client is "fetched from Nostr as an nsite and kept up to date on its own, and told to use this server first."

u/henk717, who wrote on 8 October that he is not otherwise involved, said the same thing from a binary he ran before the announcement: "The binary version doesn't include the actual armada UI, it downloads that part on first launch but seems to cache it afterwards." On the independence question he wrote that you can "combine it with the official one on top if you want to." The default relay list already does that.

Package updates come from https://pkg.soapbox.pub. The installer writes an apt source or a dnf repo, then apt-get install or dnf install of armada-stack. The blog's upgrade lines are sudo apt upgrade and sudo dnf upgrade. A hand install's armada upgrade "finds the latest release on Nostr, trusting only Soapbox's signature." The installer itself is downloaded from armada.buzz. A default server keeps a connection to the devs for the client, for the extra relays and file servers, and for the binary.

"Only accepts Armada traffic"

The blog's include list says "A Nostr relay that only accepts Armada traffic." src/relay/policy.rs says "What the relay takes: the kinds Armada uses, each in the shape Armada gives it, and who may read them. Anything else is refused." The next paragraph: "There's no NIP-42 AUTH, so nothing here depends on who's asking." The accepted kinds are 0, 3, 5, 62, 1059, 3314, 10000, 10002, 10007, 10009, 10030, 10050, 10063, 10133, 10304, 13303, 16767, 21059, 24133, 25742, 30030, 30078, 30315, 33301, 33302, and 36767. Kind 0 is a profile. Kind 3 is a follow list. A kind 1 note is refused with "blocked: kind {kind} is not accepted by this relay." The filter is the kind number. It does not check which software sent the event. The old guide's AUTH_KINDS instruction belongs to ditto-relay, a different program. This relay's policy file says it does not do AUTH.

"The server can't look inside"

The blog says "A Blossom server that only accepts encrypted uploads." The video says "Files are encrypted on your device. The server can't look inside." src/blossom/mod.rs says "Uploads and mirrors that don't look encrypted are refused." src/blossom/sniff.rs says "The server never holds a key, so it can't prove a blob is encrypted," and that it can't catch a plaintext deliberately made to look random: "compressed data with its header stripped would pass," and the check "isn't meant to." The check refuses a short blob, a known file signature, text, and bytes that fail a chi-squared test. The example config says this server "takes only encrypted blobs," so "avatars, banners and emoji are uploaded in the clear," and it tells the operator to keep a public Blossom server in the list. The default list already keeps blossom.ditto.pub, blossom.dreamith.to, and blossom.primal.net. Clear pictures go to those servers. The built-in server is the one that runs the sniff.

"One command. That's it."

The blog's steps are: a fresh VPS on Debian, Ubuntu, or Fedora; point DNS; run the curl command; "Open https://your-domain. That's it." The script that command downloads refuses to run unless it is root, on Linux, on x86_64 or aarch64, with apt at least 2.3.10 (the error names Debian 12 or Ubuntu 22.04) or with dnf. It refuses a domain that does not resolve. It enables a systemd unit. If https://DOMAIN/ does not answer in 40 tries of 3 seconds, it says ports 80 and 443 have to be open. The README also requires 7881/tcp and 7882/udp "for calls." INSTALL.md adds a firewall section for those ports and says calls' media "go to the server directly, not through Cloudflare." The video's "One binary" is the server process. The client arrives in a second download, from the nsite, after the process starts.

"NO DATABASE."

The video card is "NO DATABASE." The README says "There's no database, reverse proxy, Docker or Tor daemon to set up." config.rs says each service "keeps its database in a directory of its own." src/relay/lmdb.rs opens "A small, safe wrapper over the LMDB C API, for the relay alone," and "there is one LMDB in the binary." INSTALL.md tells you to stop the service before a backup "so the relay's database is copied in a consistent state." The sentence in the README is about what an operator has to install. The card drops that. The process creates the database itself. "NO PROXY" matches the setup claim: the package config turns on Let's Encrypt and listens on 443, so a reverse proxy is optional. trust_cloudflare defaults on for requests that come from Cloudflare's addresses.

"No owner." "No one can sink an armada."

The opening cards describe someone else's server: it can read the community, sell it, and switch it off. The product cards then say there is no owner, no center, and no off switch, and that no one can sink an armada. The key model is the part that holds. No company issued the key, and a relay that deletes an event has not deleted the key. The rest of the card is the slogan.

Soapbox Technology, LLC, of Watertown, South Dakota, holds the trademark filing and the AGPL app-store permission. Gleason has administered the soapbox.pub payee on Open Collective since 11 August 2021. The client a default stack serves is published by Team Soapbox and replaced from Soapbox's relays every ten minutes while auto-update is on. The 8 October policy says Soapbox operates relay.ditto.pub, which the default RELAYS list keeps. A community owner sets that community's relays and can remove a member. The terms say relays and communities enforce their own rules. "Take one down. The fleet sails on." is the narrower sentence, and it matches a deployment that really is using more than one relay. "No one can sink an armada." is the sentence with the limit sanded off. The same claim, in his rebuttal, was "Nobody can switch it off. Not us."

The privacy card says "No cookies. No IP logs. Nothing to hand over." The blossom module says "Nothing is logged per request" and that a client's address is held in memory while it is rate limited. The disk still holds the relay's events. Kind 0 profiles and kind 3 follow lists are in that store in the clear. Gift-wrapped messages are ciphertext. An operator can copy /var/lib/armada. That directory is something to hand over.

The calls card matches the release path

"Voice and video, through your own server" matches a packaged install that finishes. main.rs prepares the built-in LiveKit "before anything reads the AV nodes, so the built-in LiveKit is one," and if public_url is set it pushes that node onto the list before ClientEnv is built. CONCORD_AV_SERVERS is then this origin alone. INSTALL.md: "The app is pointed at this server for calls, and nowhere else." The unit test that builds ClientEnv from a default config, with no node injected, expects CONCORD_AV_SERVERS to be absent, and its comment says "Armada keeps its own." That path is a build with no LiveKit, or a start with no public_url. The official client's voice fallback, in the 8 October bundle, is https://armada.buzz, and the stack serves that nsite. Calls are also absent on the onion: INSTALL.md says "AV calls aren't offered over the onion: WebRTC can't go through Tor." The video's Tor card says "Your whole stack on a .onion address." The blog's include line is "A Tor .onion address for the whole stack." The onion serves the web app, the relay, and Blossom. It does not offer calls.

The push card says "Notifications for DMs and channels." The 0.3.0 notes say the built-in gateway "pushes events stored on this relay only: NIP-17 DMs to users whose DM relay this is, and Concord channels hosted here. Group chats and DMs on other relays don't notify."

The sentences, side by side