Texts
that open
gates.
lintel is a decentralized access network. One MIT-licensed gateway binary turns a WhatsApp or Slack message into a signed command at your gate — Discord next.
You run it — your number, your rules, your SQLite file. There is no hosted service and nothing to sign up for: the whole system is the product.
- Server
- 1 binary
- Channels
- 2 chat apps
- Lock-in
- 0 clouds
- License
- MIT
Like sending a text.
Because it is.
Residents text the word open on the channel they already use — WhatsApp or Slack, Discord soon. The gateway resolves who they are, runs your rules, and signs a command to the controller at the gate. The reply lands in the same thread.
- Identity is
(channel, sender)— one person can be reachable on several channels. - Quotas and rate limits are checked before anything moves — geofence and recurring time windows are designed, not live yet.
- Every open — and every denial — lands in the audit log within the same second.
Three moments,
two seconds.
The whole experience hides behind a chat thread. Between the message and the motor sit your rules — and an Ed25519 signature nothing on the network can forge.
-
01
A message arrives
Someone texts
open— on WhatsApp or Slack today, Discord next. The channel's webhook lands on your gateway and its signature is verified before anything else happens. -
02
Your rules decide
The gateway resolves the sender to a membership, then checks location, access point and quota — geofence and recurring time windows are designed but not wired in yet. The verdict — either way — is appended to the audit log.
-
03
A signed command goes out
An Ed25519-signed command with a nonce and expiry reaches the controller, which dialed out to the gateway — no inbound ports. It verifies against the pinned key and pulses the relay.
Ranked by how people
actually behave.
Chat is the product. Everything else exists for the days chat can't reach you — and is deliberately boring, in the way a fire escape should be.
Chat — the daily door
No app to install, no fob to lose. Anyone you trust texts the gateway from the channel they already live in. Replies, pickers and quota warnings come back inline.
The app — works offline building
Designed to quietly hold a short-lived, gateway-signed grant of your rights, so that when the internet is down it finds the controller over LAN or Bluetooth and proves itself with a challenge-response — no cloud, no Meta, no signal required. Both halves that do the verifying are real and conformance-tested today — the controller's check, and the gateway's own signed-grant issuance. What's still being built is the app itself: nothing on the phone requests, stores or presents a grant yet, so the path doesn't run end-to-end for a resident yet.
The portal
Unlimited opens through the gateway's own web portal, always. Quota warnings in chat point here.
No cloud center.
Anyone can run one.
lintel is a network of independent gateways — Go, one binary, one SQLite file.
There is no hosted service: every gateway is somebody's own, on a VPS, a Pi
behind the couch, or a box in the gatehouse. All of it MIT; the only private
thing about any gateway is its .env.
-
Bring your own channel Slack takes minutes — an app manifest and a signing secret (Discord lands next). WhatsApp needs a verified Meta business number (a WABA); Meta bills you directly for conversations on your own number.
-
Reachable your way A public IP or VPS needs nothing — the gateway manages its own certificates (ACME). Behind NAT, run any tunnel you already trust beside the binary — cloudflared, frp, Tailscale Funnel. Controllers always dial out, so they never need a port.
-
No public URL? Still a full install Slack Socket Mode (and Discord's bot gateway, when it lands) dial out — and so do controllers. A Pi on the estate LAN with no public URL is a complete installation; only WhatsApp webhooks and remote portal/app access need a URL.
-
Nothing to pay us There is no billing code in the binary — nothing to configure, nothing to pay us. Your gateway's costs are your own: your box, your channel credentials, and Meta's conversation fees on your own number.
# one binary, one SQLite file, portal embedded
docker run -d --name lintel \
-p 8080:8080 -v lintel:/data \
ghcr.io/vul-os/lintel-gateway
# point a channel at it (slack: minutes)
lintel channel add slack --manifest slack.yml
# behind NAT? bring any tunnel you already trust
cloudflared tunnel --url localhost:8080 # or frp, tailscale funnel…
✓ gateway up — portal at https://your-gate.example
✓ audit log /data/lintel.db
gateway v0.x — pre-built images are still settling pre-1.0; build from source or the
Dockerfile if docker pull comes up empty · see docs → run a gateway
Quietly serious
about access.
Only the things gate-openers actually need — each one solid enough to put in front of a body corporate. Anything not shipped yet says so.
Geofence safety planned
Designed to block opens from across town — a per-location radius with live-location confirmation when the stakes are high, denials recording the actual GPS distance. Fully specified; not wired into the gateway yet.
Time windows planned
The cleaner, every Tuesday 08:00–12:00 — recurring access that expires on its own instead of living in someone's head. Designed, not shipped; for a one-off date, a Visitor pass already does the job today.
Visitor passes beta
One-time PIN or QR sent over chat or a link. Your guest opens the gate once, the pass burns, the audit log remembers.
Time & attendance coming
The audit log already has the data — staff clock-in reports and a who's-on-site evacuation list are a settings toggle away.
Audit log
Every open, denial, pairing and config change — actor, location, verdict, message id. Append-only, exportable, kept in your own SQLite file.
Lockdown coming
One command freezes every access point at a location. Protocol support is in the signed-command contract today; the big red button ships with controller I/O.
Per-device keys
Every controller pairs once and pins the gateway's signing key. Commands carry a nonce and expiry — a captured packet is a paperweight.
Multi-channel identity
Memberships key on (channel, sender) — the same person can open from WhatsApp today and Slack tomorrow without being two people in your records.
Multi-tenant locations
House → building → complex. Move members between properties without re-pairing hardware. Roles inherit, then override.
The control room
behind the gate.
Owners and managers see every event live — filter by location, member or device, replay a denied open and see exactly which check rejected it.
Free.
All of it.
lintel has no billing system. No tiers, no wallet, no card — no code path anywhere that collects money. The code is MIT; the whole system is the product.
The code
Every line is MIT — gateway, portal, app, controller agent. There is no paid edition and no billing module; there's nothing to unlock.
The gateway
Yours. A VPS, a Pi, a box in the gatehouse — every lintel gateway is somebody's own. There is no hosted service and nothing to sign up for.
The money
Out of scope. Want to charge your residents? Do it however you like, outside the system — nothing in lintel meters, invoices or bills anyone.
No asterisks: there is no billing code in the gateway — nothing to configure, nothing to pay us. Your only costs are the ones you'd have anyway: your hardware, and Meta's per-conversation fees on your own WhatsApp number (Slack costs nothing).
The things
people ask first.
Do residents need to install anything?+
No. Residents text the gateway from WhatsApp (or Slack) like any other contact. The only people who install something are the property owner — the controller at the gate — and anyone who wants the optional app, whose emergency offline access is still being built (see below).
What happens when the internet is down?+
The app path is designed to keep working: it holds a short-lived grant, signed earlier by the gateway, and talks to the controller directly over your LAN or Bluetooth with a challenge-response — no cloud, no Meta involved. Both the controller's verification and the gateway's own grant issuance are real and conformance-tested today; what's still missing is the app itself — nothing on the phone requests, stores or presents a grant yet, so this path isn't live end-to-end for a resident yet. Controllers keep their own local button and fail-safe wiring regardless — lintel runs in parallel, never in the way, and should never be the only way out of a building.
Why is WhatsApp harder to set up than Slack?+
WhatsApp requires a verified Meta business account and phone number (a WABA) before you can receive webhooks. Slack needs an app manifest and a signing secret — minutes (Discord, when it lands, will be a bot token). You deal with Meta directly and pay Meta — not us — for conversations on your own number. Many installations run Slack-first, and add WhatsApp once the WABA clears.
Really free? What's the catch?+
There isn't one. lintel has no billing system — nothing in the binary collects money from anyone, and there is no paid edition to upsell you to. The code is MIT. If you run your own WhatsApp number, Meta bills you directly for your own conversations — that's between you and Meta, and Slack costs nothing at all. If you want to charge your residents, that's your business, outside the system.
What hardware does it work with?+
Any gate, door or barrier with a dry-contact relay input — which is most of them. The controller is a Pi-class board wired in parallel with your existing receiver, on Wi-Fi or a 4G SIM. It only ever dials out, so CGNAT and closed ports don't matter. The reference relay driver itself is still a hardware-validation scaffold, not a certified product — wire the controller in parallel with your existing fail-safe egress hardware, never as the only way out, and keep your fire/building-code release mechanisms doing their job regardless of what lintel says.
Is this secure enough for a complex with 200 residents?+
Commands are Ed25519-signed with a nonce and expiry, and each controller pins its gateway's public key at pairing — a hostile network or hijacked DNS can't forge an open. Add channel-verified identity, per-member rules, rate limits and quotas, and an append-only audit log — geofencing is designed but not live yet. Every open earns its way through. Details in the security chapter of the docs.
Do I need a public URL or a domain?+
Not necessarily. Slack Socket Mode (and Discord's bot gateway, when it lands) dial out from the gateway, and controllers dial out too — so a Pi on the estate LAN with no public URL is a complete installation. You only need a URL for WhatsApp webhooks and for reaching the portal or app from outside the property; then it's a public IP with the gateway's built-in ACME, or any tunnel you already trust running beside the binary.