Diwan ديوان
Part of Vulos

No account · No telemetry · No lock-in

Diwanديوان

A real, self-hostable collaborative office suite you own.

Documents, spreadsheets, slides and whiteboards in one warm, modern web app — shipped as a single Go binary with the entire frontend embedded. Real-time co-editing is peer-to-peer and CRDT-native: there is no central document server. Your files live in your own storage.

Get Diwan Read the docs Source
One Go binary Five surfaces Zero accounts CRDT peer-to-peer MIT / Apache-2.0
localhost:8080 — your workspace
The Diwan workspace: a warm ivory home screen with Docs, Sheets, Slides, Whiteboards and PDF in the left rail, and recent files listed on the right. The Diwan workspace in its warm dark theme.
01Surfaces

Five surfaces, one binding

Documents-only by design — Docs, Sheets, Slides, Whiteboards and PDF. Chat, video and mail are deliberately not part of it. Each surface carries its own calm hue, so the suite is findable at a glance.

Apps
Docs — Architecture Decision Record
The Diwan document editor: rich text with a live outline, anchored comments and a formatting toolbar. The Diwan document editor in the warm dark theme.

Docs. Headings, tables, inline images, footnotes, task lists and links. Anchored comments, suggestions with accept and reject, version history with restore, find and replace, a live outline and a word count.

02Collaboration

Co-editing without a middleman

Real-time editing that no server can read. Peers converge with no authority in the middle — because edits are conflict-free, and the room key never leaves your browser.

CRDT UPDATES · END-TO-END ENCRYPTED Your browser ROOM KEY · LOCAL A collaborator ROOM KEY · LOCAL Another collaborator ROOM KEY · LOCAL CONTENT-BLIND RELAY HARD-NAT FALLBACK ONLY

No central document server

Docs and whiteboards sync as Yjs updates; Sheets and Slides use last-write-wins and tree CRDTs. Peers connect directly over WebRTC. The only server role is content-blind peer discovery — it learns that peers share a random room id, never any content.

End-to-end encrypted rooms

Every session runs inside an encrypted room whose key never reaches any server. Share by invite link — the key rides the URL fragment, which browsers never send upstream. A content-blind relay steps in only as a hard-NAT fallback.

Standalone, always

Point Diwan at any self-hosted rendezvous service and peer-to-peer co-editing works with no Vulos OS and no host box required. Set nothing, and it stays local-only. Nothing is hosted for you unless you choose it.

03Install

One binary, your storage

Diwan runs by itself — no account, no cloud, no external service required. No database server either, unless you want one.

bash
# Docker — one line
$ docker run -d --name diwan \
    -p 8080:8080 \
    -v diwan-data:/srv/data \
    ghcr.io/vul-os/diwan:latest

# …or build the single binary from source
$ git clone https://github.com/vul-os/diwan.git
$ cd diwan
$ npm install && npm run build
$ ./diwan
  1. 01
    Run itThe Docker one-liner, or build from source with Go 1.25+ and Node 18+. The whole frontend is embedded in the binary — there is nothing else to serve.
  2. 02
    Open the appHead to http://localhost:8080. Single-user with local storage by default; data lives in ./data and ./uploads.
  3. 03
    Own itOptionally turn on auth, PostgreSQL, or an S3-compatible store, and point it at a rendezvous service for peer-to-peer co-editing. Every one of those is opt-in.
04The register

What you actually get

Plainly, and without the marketing. If it is not in this register, Diwan does not do it.

Storage
Local filesystem by default. Optionally PostgreSQL, or any S3-compatible bucket you control.
Formats in & out
.docx .xlsx .csv .pptx .pdf .md .html — open formats in both directions, no lock-in.
Accounts
None. Auth is off by default and single-user; turn on a password when you want one.
Telemetry
None. Nothing phones home. Fonts are self-hosted, so a self-hosted install leaks no address either.
Collaboration
Peer-to-peer over WebRTC, end-to-end encrypted, CRDT-native. A content-blind relay only as a hard-NAT fallback.
Deliberately absent
Chat, video calls and mail. Diwan is a documents product; those belong to other tools.
Runtime
One Go 1.25 binary with a React 18 frontend embedded. No Node at runtime, no database server required.
Licence
MIT or Apache-2.0, at your option. Fork it, ship it, keep it.
05Colophon
ديوان

On the name

dīwānn. — the bureau
The office of registers: the room where records were written, bound and kept, and the clerks who kept them.
dīwānn. — the collection
A gathered volume: the complete works of a single author, assembled and bound in one place rather than scattered.

Both senses are the same promise. Your documents, gathered and bound, in your own keeping — not scattered across somebody else's servers.

The mark is an iwan — the vaulted portal at the heart of Persian and Ottoman architecture: the arch you pass through to reach the room where the registers were kept. Give it a quarter turn — it becomes a D

06Family

Part of Vulos

Vulos is a family of open, self-hostable apps. Diwan is a fully standalone product — it never requires Vulos infrastructure — but it also installs as a one-click app on a Vulos OS box, where the same binary runs behind the box gateway with scoped storage and single sign-on. Self-hosting it yourself is always the default path, and never second-class.

Explore Vulos →