Run the relay
Last updated
Self-hosting a Weald relay takes three commands on a host you already have. It also needs a hostname and an open port 80 for certificate issuance. The bundle brings Postgres, object storage, Redis and TLS with it.
Self-host when a contract, a residency rule or an internal policy requires project data to stay in your account, region or network. There is no email gate, no access request and no seat limit. The relay you run is the same image the hosted tier runs.
The whole sequence
- Check the requirements: a host, a hostname, disk, and a Mac to run the client on.
- Install the relay with the three commands below.
- Set the configuration you need. Three values are required and the rest have working defaults.
- Point DNS and TLS at the host and let the bundle issue a certificate.
- Redeem the bootstrap invite and create the first workspace.
- Set up backups before you invite anyone.
- Verify the encryption claim yourself, once.
The three commands
curl -fsSL https://get.weald.team/relay | sh cd weald-relay && cp .env.example .env && $EDITOR .env docker compose up -d
The first command fetches the compose bundle. The second opens the environment file, where the hostname is the value you must set. The third starts Postgres, object storage, Redis, the relay and a TLS terminator.
Four ways to deploy
Most self-hosters run compose on a virtual machine, which is what the three commands above do. The relay is a small binary, so three other paths exist for teams that do not want a container on a fresh box.
| Path | Good for | What you give up |
|---|---|---|
| Compose on a VPS | Most teams, ten minutes end to end | Nothing, this is the default |
| Provider template | Railway, Fly, Render, DigitalOcean App Platform | The provider runs Postgres and the bucket |
| Bare binary with systemd | Teams with existing Postgres and configuration management | TLS termination is yours to arrange |
| Private network, no public ingress | An enterprise that wants no internet exposure | ACME and public DNS, which you no longer need |
The private network path is a supported deployment. The relay binds to a Tailscale or WireGuard interface and clients reach it over the same network. Nothing is published in public DNS or exposed to the internet.
What the relay can and cannot do
A relay stores ciphertext envelopes and routing metadata. It has no key for any workspace and runs no search index. It has no admin password, no operator account and no web admin panel, because an operator has nothing to administer.
Workspace administration happens in the client, signed by a device that holds the right to admit members. An operator who is not a workspace member cannot add a member, read one, or see who they are.
After it is running
Operate covers the health endpoints to alert on and the numbers that measure capacity rather than people. Upgrades moves between versions by digest instead of by tag. Troubleshooting lists the failures this bundle produces.
To leave, take a backup, restore it somewhere else and repoint the client. There is no export format and no data liberation feature. The relay holds nothing that your own devices do not already have.