Madar Suite Documentation
Architectural and operational guides for Madar Personal, Self-Hosted Workspace Server, Policy Engine, and REST/WebSocket APIs.
Getting Started & Architecture
Core concepts, system architecture, multi-vault isolation, and hardware sizing.
Platform Overview
How Madar serves individuals with private encrypted messaging and organizations with self-hosted governed workspaces.
System Architecture & Control-Plane Isolation
Detailed breakdown of the four operational planes: Adaptive Agent, Core Data Plane, Isolated Admin Console BFF, and Blind Cloud Relay.
Multi-Vault Device Isolation
How the client isolates 1 Personal Vault and up to 4 Enterprise Workspace Vaults with separate keys and databases.
System Requirements & Reference Sizing
Hardware, operating system, database, and network port requirements for Small, Medium, and Large deployments.
Madar Personal
End-to-end encrypted personal messaging, Waves, Pulse status, Moments, and calls.
Phone Verification & Signal Setup
How users sign in to Madar Personal using phone OTP verification and generate their device identity keys.
End-to-End Encrypted Messaging (X3DH)
Cryptographic specification of Madar Personal 1:1 and group conversations, media encryption, and safety numbers.
Waves, Pulse Bar & 24-Hour Moments
Relationship-focused social features in Madar Personal: lightweight Waves, live Pulse status, and ephemeral 24-hour Moments.
Voice/Video Calls & QR Invite Cards
Real-time WebRTC voice and video calling with built-in STUN/TURN signaling and revocable personal QR invite cards.
Self-Hosted Deployment
Docker Compose setup, environment variables, TLS reverse proxy, and blind push relay.
Docker Compose Deployment & Setup Script
Step-by-step instructions to deploy a self-hosted Madar Workspace server and isolated Admin Console using Docker Compose.
Environment Variables Reference
Complete reference of configuration variables for madar_server and madar_admin_console.
Reverse Proxy, TLS & Control-Plane Isolation
Recommended Nginx and Caddy configurations to expose the data plane while keeping the Admin Console on a restricted subdomain or internal network.
Air-Gapped Operation & Blind Push Relay
How mobile push notifications work in self-hosted environments using 128-bit opaque handles and zero-content wake signals.
Workspace & Identity Administration
First-boot wizard, DNS verification, QR device enrollment, OIDC/SAML/LDAP SSO, and RBAC.
First-Boot Setup Wizard & Domain Verification
Initializing your workspace, generating Ed25519 policy signing keys, and verifying official domain ownership via DNS TXT.
Device Enrollment via Signed QR Tokens
How administrators issue single-use or multi-use Ed25519-signed enrollment tokens and bind employee devices.
Enterprise SSO (OIDC / SAML / LDAP) & Directory Sync
Configuring OpenID Connect, SAML 2.0, and Active Directory LDAP providers with automated 15-minute user provisioning and offboarding.
Administrative Roles & Separation of Duties
Role hierarchy (SUPER_ADMIN, IT_ADMIN, COMPLIANCE_OFFICER, EXEC_MANAGER, DEPT_HEAD, BROADCASTER, MEMBER) and Separation of Duties enforcement.
Institutional Communication & Memory
Verified broadcasts, comprehension quizzes, decisions log, follow-ups, and Action Hub.
Verified Broadcasts & Comprehension Quizzes
Publishing official circulars with reference numbers, three acknowledgment tiers, version tracking, and material revision resets.
Institutional Channels & Privacy Modes
Department channels, project rooms, and privacy modes: Standard Governed, Enhanced Privacy, and Confidential E2EE.
Decisions Log, Superseding, Follow-ups & References
Preserving institutional memory inside every channel with immutable decisions, superseding chains, assigned follow-ups, and weekly digests.
Action Hub & Orthographic Arabic Search
Centralized view of pending broadcast acknowledgments, assigned follow-ups, and active decisions, paired with Arabic orthographic search.
Security, Governance & Compliance
Signed 28-key policy engine, DLP watermarks, selective wipe proof, and SHA-256 audit chain.
Signed 28-Key Policy Engine & Anti-Rollback
How the 28-key hierarchical policy catalog is evaluated across scopes, signed with Ed25519 JWS, and verified by clients.
DLP Watermarks & Cryptographic Selective Wipe
Dynamic identity watermarks, copy/paste and external share controls, 30-day offline self-wipe, and Ed25519 signed wipe proofs.
SHA-256 Audit Chain, Legal Hold & Break-Glass
Tamper-evident hash-chained audit logs, CSV formula-injection protection, legal hold preservation, and dual-control Break-Glass inspection.
API, Realtime & CLI Reference
REST API v1 endpoints, WebSocket first-frame protocol, and madarctl operational commands.
REST API v1 Reference
Summary of core endpoints across Discovery, Enrollment, Authentication, Policy, Channels, Broadcasts, Hub, Search, and Admin Control Plane.
WebSocket Realtime Protocol & First-Frame Auth
Authenticating WebSocket connections without URL query tokens and handling real-time events.
madarctl CLI Reference & Operations
Using madarctl for health diagnostics, audit chain verification, Ed25519 key rotation, and admin recovery.