Eleven places
Last updated
You can put a Weald relay in eleven places without writing a compose file. The deploy page is the grid of them, one link each. This page adds what each provider runs for you, what it costs you in control, and the step that fails on all of them.
Every path installs the same published image, pinned to the same digest, with the same three required settings. A provider choice changes who runs the database and who holds the certificate. The relay stays the same and still reads nothing.
Which one to take
| You have | Take | What the provider runs |
|---|---|---|
| A VPS you are about to create | Paste cloud-init.yaml into the user-data box | Nothing, the bundle brings it |
| A Hostinger VPS | Docker Manager, pointed at our compose file by URL | Nothing, the bundle brings it |
| A Render, Fly, Railway or DigitalOcean account | That provider's template | Postgres, storage, TLS |
| Coolify, Dokploy or CapRover already installed | Paste the artifact for it | Its own reverse proxy and certificates |
| A box at home | Umbrel, or the compose bundle | Nothing, and there is no public ingress |
| A Mac and no server | Weald Relay Host | Docker on your Mac |
The provider-template row needs the most thought. It hands Postgres and object storage to the provider, with their backups, their durability and their bill. Teams usually want that, and it is also a managed service whose source you did not read.
The compose bundle makes the opposite trade on both counts.
The step that goes wrong
First boot prints a one-time enrollment URL, once. On a one-click path it appears in the provider's log view, and people close that view.
The URL lives for 24 hours and can be reissued while the workspace has no trust root yet:
docker compose exec relay wealdrelay bootstrap --reissue
Once a device has claimed it, reissue refuses, permanently. The workspace trust root cannot be reset. Open that URL first on the Mac you intend to administer the workspace from.
The cloud-init.yaml and StackScript paths also write the URL to /root/weald-enrollment.txt, since nobody watches a log view on those paths.
What none of them will do
No path gives you an admin panel, an operator account or an admin password, because an operator has nothing to administer. Members are admitted in the client, signed by a device that holds the right to admit. An operator who is not a member of the workspace cannot add a member, read one, or see who they are.
No path weakens the access set. Every artifact sets WEALD_RELAY_ACCESS_SET=enforce and none of them offer a switch. Setting off is defensible on a private network with no public ingress, which you decide in configuration and every member's encryption panel then shows.
No path publishes the observability listener. Metrics and readiness are on port 9090, bound where only the machine can reach them.
Before you invite anybody
Set up backups. On a provider-template path this is the provider's backup feature, and you should turn it on rather than assume it. On the compose paths it is a pg_dump and a copy of the bucket, and this documentation puts it before the invite because people skip it.