Skip to content

relay-v0.1.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 20 Jul 08:08
· 597 commits to main since this release
relay-v0.1.0
ad24656
This commit was signed with the committer’s verified signature.
wilsonglasser Wilson Glasser
SSH Key Fingerprint: hIGhVVXdrgkGThPbhENfKEVDh08H7Jf4oEpyugaJfVQ
Verified
Learn about vigilant mode.

First standalone release of oryxis-relay, the self-hostable signaling
and relay server for Oryxis sync. It lets two devices that are not on
the same LAN find each other and exchange sync traffic without any
hosted service in the middle. The relay only ever sees ciphertext.

Running your own relay is optional. LAN sync (mDNS + QUIC) needs
nothing, and the SFTP snapshot backend covers the internet case without
a server. This is for people who want a persistent endpoint they
control.

Docker (recommended)

Multi-arch image on GHCR, linux/amd64 + linux/arm64:

docker run -d \
  --name oryxis-relay \
  --restart unless-stopped \
  -p 8080:8080 \
  -e ORYXIS_RELAY_TOKEN=<long-random-string> \
  ghcr.io/wilsonglasser/oryxis-relay:latest

Tags: ghcr.io/wilsonglasser/oryxis-relay:0.1.0 and :latest.
The image is distroless/static (no shell, no glibc) around a
musl-static binary, so it is a few MB and runs as nonroot.

Binaries

The assets below are the same server without Docker, for Linux
(x86_64 / aarch64), macOS (Apple Silicon) and Windows (x86_64):

oryxis-relay --port 8080 --token <long-random-string>

Every flag also reads an environment variable: ORYXIS_RELAY_PORT,
ORYXIS_RELAY_BIND (default 0.0.0.0), ORYXIS_RELAY_TOKEN. The
token is required and must be at least 16 characters; the server
refuses to start without one.

Pointing the app at it

Settings > Sync has a Set up your own relay wizard that generates
the compose / systemd / Caddy files for you and adopts the endpoint
after probing /healthz. To do it by hand, paste the URL and the token
into Settings > Sync > Advanced.

Put it behind a reverse proxy for TLS. One thing to get right: the
long-poll inbox holds a request for up to 120 s, so the proxy needs a
read timeout above 150 s or peers will see spurious disconnects. A
ready made nginx block, plus the Cloudflare Worker alternative, are in
SELF_HOSTING.md.

What it does

  • Bearer-token authenticated signaling: device discovery and offer /
    answer exchange for the QUIC transport.
  • Store-and-forward relay for peers that cannot reach each other
    directly, with a bounded per-recipient queue (256 messages, 5 minute
    TTL) so a device that never comes back cannot grow the server.
  • GET /healthz for probes and for the in-app wizard.

Source: crates/oryxis-relay.
AGPL-3.0-or-later, like the app.

Assets 6
Loading