MChan
MChan is a server-rendered anonymous Malaysian higher-education imageboard. Visitors can read approved boards, create text threads, reply anonymously, and report threads or replies without normal user accounts. The engineering problem is to keep an anonymous, inexpensive community useful without pretending that anonymity removes abuse, moderation work, or operational responsibility.
The current beta keeps public pages deliberately small: boards, thread pages, anonymous text posting, thread-scoped public poster IDs, reports, and read-only archives. Public readers do not receive accounts or persistent pseudonyms. The application is server-rendered, so the core experience does not depend on a frontend framework, Node, PostgreSQL, Redis, or object storage.
I lead MChan's system design. I built mchan-core, with
contributions from realmxrza, along with the Telegram bridge, image
processor, and operations tooling. The Miya screening service is built
mainly by JavanMyna.
Moderation and privacy
Human moderation is the authority. Protected web moderation provides report queues and abuse-log views, while moderators can dismiss or resolve reports and hide, remove, quarantine, lock, or pin content. Admins can apply board and site bans; assigned board moderators are limited to their boards and cannot perform every global action. These transitions write atomic audit records instead of relying on a report count to remove content automatically. Reports are rate-limited, and public pages do not expose the restricted operational data used to investigate abuse.
Post-origin records are encrypted, access to them is protected and audited, and cleanup currently runs on a 30-day retention window. This is separate from the public poster ID shown inside a thread. Cloudflare Access identity is used for staff controls behind the isolated origin; it does not create a browser session for ordinary readers or posters.
Small services, graceful degradation
The main application, mchan-core, is Rust with Tokio,
Axum, Askama, SQLx, and SQLite, packaged with Docker and deployed
behind Cloudflare. Optional services keep the base system usable when
they are absent. The mchan-image processor validates JPEG,
PNG, and WebP uploads; if it is disabled or unavailable, text-only
posting continues. Miya can allow, flag, or block text, but it never
replaces human moderation. A flagged post is held hidden until a
moderator approves it, and an unavailable screening service publishes
the post with an audit note rather than silently blocking it.
mchan-telegram brings the boards to Telegram. One bot takes
anonymous submissions in private chat and sends them through the same
posting pipeline as the web, including bans, rate limits, Miya, and
moderation. Each board is then projected into its own read-only
confession channel. Raw Telegram identities are never stored. The
bridge serves eight UM confession channels, which have about 2.2k
active members.
mchan-ops monitors the services, host, and backups.
It and the Telegram bridge deploy only after CI passes: a fixed-tag
image is shipped to a restricted SSH receiver, and a candidate container
is promoted only after its health check passes. The
mchan-core service also provides authenticated Discord moderation and best-effort Discord report
notifications. These support staff workflows without becoming
requirements for public reading.
Boundaries
MChan is open beta and active development. Accounts, persistent pseudonyms, institutional verification, search, board proposals, author deletion tokens, video or audio uploads, popularity metrics, recommendation feeds, public moderator identities, and automated report-count takedowns are not implemented. Those boundaries preserve a cheap infrastructure target and keep moderation decisions explicit.
Status: Open beta, active development.
Source: MChanTeam/mchan-core.