Failed to connect

[imgurbot12]

Hello, this project seems highly interesting as someone that's been interested in getting my normie friends to use a private IRC server for groupchats. 😄

I tried to do a basic test with a local instance of unrealircd, since that seems to be the best supported, but I can't seem to get the tauri app to successfully connect. I get the following error with no logs from the console:

The same error occurs with port 6697 and 6667.
I built from source using the latest commit from master, and also the tagged version v0.2.5 with both having the same issue.

[anotherdoesnm]

are you sure you have TLS port available? (6697)

[imgurbot12]

unrealircd seems to think so and the port is open on my system so I believe so, but like I said it failed to work with 6667 as well. It is using a self-signed cert obviously since im running it on localhost for testing.

EDIT: The connection u see in the logs there was me using irssi to test that unrealircd was working correctly. There is no indication in the logs from unreal that obsidian even made an attempt to connect.

[imgurbot12]

Trying to debug for myself and I'm very confused on where the problem lies since after inspecting the code it just looks like its supposed to be a standard tcp connection using tokio's TcpStream.

I even added a logger to confirm the section was running and it is, but it obviously fails to connect when I know for a fact that the socket is running and available.

    // Create TCP connection
    log::info!("connecting to {host}:{port}");
    let tcp_stream = TcpStream::connect(format!("{}:{}", host, port))
        .await
        .map_err(|e| format!("Failed to connect to {}:{}: {}", host, port, e))?;

[imgurbot12]

Oh interesting. After further investigation I found two problems.

1. Obsidian assumes ircs:// even when port 6667 is specified over 6697 or you try to manually pass a protocol prefix yourself via the server input which meant my testing with 6667 would have never worked.

2. Because my unrealircd instance uses a self-signed cert, tokio is giving up because it can't verify the certificate and there does not appear to be an option to allow for a self-signed cert.

(these are my own log messages i added in during testing)

[2026-03-12][07:53:42][app_lib::socket][INFO] we're using tls? localhost:6697
[2026-03-12][07:53:42][app_lib::socket][ERROR] TLS CONNECT ERROR: error:0A000086:SSL routines:tls_post_process_server_certificate:certificate verify failed:ssl/statem/statem_clnt.c:2125: (self-signed certificate)

[anotherdoesnm]

oops sorry i forgot: obsidianirc doesn't support self-signed certificates in non-local instances
but it should be bypassed at localhost

[imgurbot12]

oh interesting. I'm not seeing any logic on the rust side of things that would seemingly allow for a self-signed certificate if the host is localhost, and that does not seem to be the case based on my testing lol. seems like it's definitely worth adding though.

[anotherdoesnm]

@matheusfillipe @ValwareIRC how you're testing stuff locally?

[matheusfillipe]

We don't support non SSL sockets.
We don't support self-signed certs.

Do not input the protocol in the domain field. Use the latest release. We only wish to support ircs and wss.

@matheusfillipe @ValwareIRC how you're testing stuff locally?

You can create locally trusted certs :

https://github.com/ObsidianIRC/ObsidianIRC/blob/main/CONTRIBUTING.md#local-development--testing
TLDR:

# Needs mkcert
npm run gen-certs

docker compose --profile testing up 

npm run tauri dev

Then connecting to localhost 6697 works.

[matheusfillipe]

oops sorry i forgot: obsidianirc doesn't support self-signed certificates in non-local instances
but it should be bypassed at localhost

This is no longer the case. There is no bypass for local dev anymore

[imgurbot12]

Greatly appreciate the clarification thank you.

I understand wanting decent security by default, but would it not be better to allow an individual to choose lesser security options if they explicitly asked for it?

Say I want to test a different IRC server with obsidian rather than unrealircd running on localhost or maybe just in a test environment not even on localhost. It seems you're suggesting that's impossible right now unless u manually modify the code to do so.

At the very least the current implementation does seem a bit unintuative since I had no idea non-tls connections or self-signed certs were impossible from the UI until I dove into the codebase directly.

[matheusfillipe]

Say I want to test a different IRC server with obsidian rather than unrealircd running on localhost or maybe just in a test environment not even on localhost. It seems you're suggesting that's impossible right now unless u manually modify the code to do so.

It is not impossible and I just provided an example of how to do it with ergo which is in the local test docker compose file: #159 (comment) and that is how I test it locally with SSL without any code modification.

https://github.com/filosottile/mkcert

At the very least the current implementation does seem a bit unintuative since I had no idea non-tls connections or self-signed certs were impossible from the UI until I dove into the codebase directly.

I agree with that. I am not saying we don't want to make that more clear or maybe even support it. It has caused issues in the begging so we just dropped that as it is very low-prio at the moment.

In general it has become very easy to obtain trusted certs for free with ACME from let's encrypt or ZeroSSL etc. I find it hard to find to justify supporting it in mainline releases as these are very standard bare minimum security nowdays. I can agree though with clearer error messages and tooltips or documentation. PR's are welcome.

[imgurbot12]

It is not impossible and I just provided an example of how to do it with ergo which is in the local test docker compose file: #159 (comment) and that is how I test it locally with SSL without any code modification.

Perhaps, but configuring trusted certs with a CA traditionally complex and very annoying as mkcert says in their readme lol

Managing your own CA is the best solution, but usually involves arcane commands, specialized knowledge and manual steps.

Maybe mkcert makes it simpler for running it all on the same device but trying to do anything more advanced than that is still a headache and remains a pain point for flexible dev and testing environments.

Additionally, If i want to test with a non-encrypted irc server (using port 6667) that does remain impossible, despite the fact that the backend code supports it.

PR's are welcome.

I am considering contributing if y'all would support modifications to allow such changes, and to improve the error messaging but whilst I am very familiar with rust, I have no experience with typescript or react for that matter and the code did not read intuitively for me as someone who's never used it before, so it would take me some time to learn enough to be able to contribute properly.

[matheusfillipe]

I am considering contributing if y'all would support modifications to allow such changes, and to improve the error messaging but whilst I am very familiar with rust,

I understand you, but right now, only improving docs/error messages is what we want to consider in reguards to that.