◂ Help Center

Self-Host the Relay

Run your own deaf server. What the relay does, what it must never do, and the operator's contract for keeping it honest.

Builder Build & Self-Host updated Jun 27, 2026

The relay is meant to be disposable and replaceable. No single relay is load-bearing for the movement—if one disappears or turns hostile, Orbits route around it. Running your own is the surest way to verify the privacy claims: inspect exactly what crosses the wire.

What the relay is

A dumb pipe with a good memory and zero loyalty. It accepts encrypted envelopes addressed to a hash and delivers them to that hash. That’s the job.

  • Stateless about people; stateful only about undelivered envelopes.
  • No account system, no profile, no directory.
  • No analytics, no telemetry, no third-party calls.

The operator’s contract

If you run a relay, you are agreeing to run a deaf one. The relay must not:

  • Log IP addresses, user agents, or any client fingerprint.
  • Store plaintext—envelopes are end-to-end encrypted before they arrive and the relay never holds keys.
  • Build or persist a contact graph (who talks to whom over time).
  • Retain delivered envelopes beyond delivery.
  • Add a backdoor “for safety.” A backdoor is the whole thing the design exists to prevent. See The Deaf Server.

A relay that does any of these is not a RORBT relay. The point of self-hosting is that anyone can check.

Minimum operational shape

# conceptual—the reference relay config keeps it boring on purpose
relay:
  bind: 0.0.0.0:8443
  tls: required          # transport encryption in addition to E2E payloads
  logging: off           # no request logs, no access logs
  metrics: off           # no telemetry
  retention: until_delivered
  max_envelope_bytes: 65536

Keep it boring. The most trustworthy relay is the one with the least to configure, the least to log, and the least to leak.

Verifying a relay you don’t run

  • Confirm payloads are opaque on the wire (E2E, not just TLS).
  • Confirm there’s no directory or membership endpoint to enumerate.
  • Confirm logging is genuinely off—not just “anonymized.”

Status & next

The reference relay implementation, wire format, and hardening checklist are being finalized in the Protocol Spec. The adversaries this is all designed against are enumerated in the Threat Model. For coordination between relays and Orbits, see Federation.