Skip to content

WiltKey Server v1.1

Choose a tag to compare

View all tags
@ArtFacility ArtFacility released this 01 Jul 13:20
· 21 commits to main since this release
v1.1-server
6319771

WiltKey Server Relay 1.1 — Security Hardening

A security-focused release of the WiltKey blind relay. Self-hosters should replace
their relay binary with the matching build below. No client/app update is required —
all changes are server-side.

What changed

  • Fixed a critical flaw where a malicious client could crash the entire relay
    or silently hijack/deny another user's message delivery. The unused legacy code path
    responsible (ephemeral tunnels) was removed entirely, and the message-send path was
    made panic-safe.
  • Abuse protections added: per-connection flood limiting (token bucket), bounded &
    self-purging offline queues (can't be inflated to exhaust memory), and per-sender
    rate-limiting on remote-wipe (nuke) signals with a shortened block window.
  • Restored per-IP rate limiting & bans behind a reverse proxy by reading the real
    client IP (X-Real-IP/X-Forwarded-For, trusted only from the loopback proxy).
  • Hardened the HTTP message-post endpoint: single-use vouchers and stronger
    proof-of-work.

Confidentiality was never affected — the relay only ever handles opaque hashes and
end-to-end-encrypted payloads it deletes on delivery. These fixes are about
availability and abuse resistance.

Which file do I need?

File Platform
wiltkey-relay-linux-amd64 Linux x86-64 (most VPS/servers)
wiltkey-relay-linux-arm64 Linux ARM64 (Raspberry Pi 4/5 64-bit, ARM VPS)
wiltkey-relay-windows-amd64.exe Windows x64
wiltkey-relay-darwin-amd64 macOS (Intel)
wiltkey-relay-darwin-arm64 macOS (Apple Silicon)

Run it

# Linux/macOS (chmod +x first)
chmod +x ./wiltkey-relay-linux-amd64
PORT=8090 REDIS_ADDR=localhost:6379 REDIS_DB=1 ./wiltkey-relay-linux-amd64
# Windows
$env:PORT="8090"; $env:REDIS_ADDR="localhost:6379"; .\wiltkey-relay-windows-amd64.exe

For a production, internet-facing relay (TLS, reverse proxy that forwards the real IP,
firewalling Redis), follow the Setup & Security Guide:
https://wiltkey.org/docs/relay-server.html#self-hosting

Verify your download

Checksums are in SHA256SUMS.txt:

sha256sum -c SHA256SUMS.txt

Built from source with -trimpath -ldflags="-s -w".

Assets 8
Loading