Self-hosting the sync relay

What the relay does

The relay stores authenticated, encrypted records and the revisions that order them, and hands them to your other devices. It never processes speech and never sees plaintext.

Devices push batches of encrypted changes, pull with an opaque cursor, and are enrolled or revoked through the relay.

One core, two account modes

The same core runs hosted and self-hosted. It knows devices, envelopes, revisions and cursors, not accounts. An account gate in front of it has two modes.

noop, the default for self-hosting: there are no accounts. Every request is authenticated by the signature of an enrolled device.

oidc: the relay also requires a bearer token from an OpenID Connect issuer, checks its issuer, audience, expiry and sync entitlement, and maps the token's issuer and subject to a tenant. Device signatures are still required. AstraFoundry's hosted relay runs in this mode, and you can point it at your own identity provider.

What you see as an operator

Timing, IP addresses, device and group routing identifiers and ciphertext sizes. Not content: backups of the relay database hold ciphertext only.

Running it

The relay is a Go service with its own PostgreSQL database. Its container image, configuration reference and runbook ship with the first release.