Relay supports self-hosting your Relay Server for added privacy.
While you cannot self-host the entire Relay service, hosting an on-premise Relay Server provides you with full privacy for your documents and attachments. Relay's Control Plane handles login and permissions management, but is unable to read the contents of your documents.
The simplest setup for personal use is to host a Relay Server with Docker and use Cloudflare R2 for data persistence.
Contact us to get an auth token for your on-premise Relay Server.
discord: https://discord.system3.md
email: daniel@system3.md
When hosting an on-premise Relay Server there is an auth token that is shared between the Relay Control Plane and your Relay Server. The shared auth token allows the Relay control plane to issue tokens which grants users access your Relay Server.
It is technically possible for the Relay control plane to issue an access token and then use it to connect to your Relay Server if it is hosted on the public internet.
To ensure that your documents are fully private, you need to host your Relay Server on a private network such as a tailscale tailnet or a corporate VPN. If you don't already have a private network set up, we recommend using tailscale.
Whenever you change the URL of your server, you will need to update Y_SWEET_URL_PREFIX to your new url and notify us.
Before we can start the Relay Server container, we need to configure the environment.
This auth.env file is a template for all of the variables that you need to set.
# Auth Token from Relay Team (contact daniel@system3.md)
Y_SWEET_AUTH=${AUTH_TOKEN}
# Cloudflare R2
AWS_ACCESS_KEY_ID=${AWS_ACCESS_KEY_ID}
AWS_SECRET_ACCESS_KEY=${AWS_SECRET_ACCESS_KEY}
AWS_REGION=auto
STORAGE_BUCKET=${BUCKET}
AWS_ENDPOINT_URL_S3=https://${CLOUDFLARE_ACCOUNT_ID}.r2.cloudflarestorage.com
Y_SWEET_STORE=s3://${BUCKET}/
# Tailscale
TAILSCALE_AUTHKEY=${TAILSCALE_AUTHKEY}
TAILSCALE_USERSPACE_NETWORKING=true
# Tailscale Tailnet Address
Y_SWEET_URL_PREFIX=http://relay-server.${TAILNET_NAME}.ts.net:8080Once you have all of the environment variables configured you can run the server with docker. This command runs the server interactively so you can check the logs to ensure that the server starts successfully.
docker run -it \
--name relay-server \
--env-file auth.env \
docker.system3.md/relay-serverTemplates:
Instructions: fly.io hosting
Templates:
Kubernetes with Tigris + Azure Key Vault
The Relay Collaboration Server is a fork of y-sweet by the talented folks at jamsocket.com
y-sweet builds on y-crdt by Bartosz Sypytkowski, Kevin Jahns, and the y-crdt community.
The server source code is MIT licenced and available here.