Projects / Chatwoot

Chatwoot + minidauth support conversations only a granted agent can read

A support tool holds who your customers are and everything they told your team. In this fork of Chatwoot, the open source Zendesk alternative, a contact's name and phone and the body of every message are sealed before they reach Postgres, and open only for an agent a quorum granted the reading role. It is the first non-Node integration, proving the sealing sidecar is language-agnostic.

Open the fork Upstream Chatwoot

Run end to end

What gets sealed

Chatwoot is the open source Zendesk alternative. These fields are stored as ciphertext, and nothing on the server can decrypt them.

Contacts
Name and phone number. Email and identifier stay in the clear, as the lookup keys Chatwoot dedupes and routes contacts on.
Messages
The body of every message in a conversation.

How it's wired

  1. Sealed on write

    A small ActiveRecord concern seals the chosen fields in a before_save, so every write of a contact or a message goes through one place, and ciphertext is what reaches Postgres.

  2. Opened per agent

    An after_find opens the fields as the signed-in agent Chatwoot already tracks for each request, so a sealed field opens only for that verified agent.

  3. Gated by a quorum role

    A field opens only if minidauth's quorum grant says that agent holds the reading role. An agent without it sees ciphertext, and revoking it makes the same read go dark.

The key that seals these fields exists only as shares across the Tide network, and 14 of 20 nodes have to cooperate to use it. It is never on the Chatwoot server.

Details that matter

  • The sidecar holds no reading identity of its own. Opening is delegated per agent and gated on a quorum-granted role.
  • With no agent in context, a field stays sealed, so there's never an open decryption service to abuse.
  • The Ruby side signs its short-lived reader token with a private key rather than a shared secret, so a copy of a config file is worthless.
  • The tool's derived, pre-rendered copy of a message is dropped on write, so it can't shadow the sealed value.

Status and running it

A proof of concept, off unless MINIDAUTH_SEAL_URL is set, so an unconfigured checkout behaves exactly like upstream Chatwoot. The fork's README covers setup against a running minidauth.

Want to do the same for another app, or stuck running this one? Join the Discord and I'll help you out.

Other projects: Formbricks · Twenty · Cal.diy · Documenso · Medusa · Rocket.Chat · Firefly III · Integrations