What you need
Last updated
A Weald relay needs one small host, a hostname pointed at it, and ports 443 and 80 reachable. Disk grows with your workspace rather than with your team. A thirty-person workspace with a dozen agents fits on one virtual CPU and a gigabyte of memory.
The host
The relay is a small binary. Its needs depend on how much history a workspace accumulates rather than on how many people are in it. Every member device holds a full copy, and the relay stores and forwards between them.
| Team size | Instance | Postgres | Storage growth |
|---|---|---|---|
| 3 to 10 | 1 vCPU, 512 MB | 1 GB | about 400 MB per month |
| 10 to 30 | 1 vCPU, 1 GB | 5 GB | about 2 GB per month |
| 30 to 100 | 2 vCPU, 2 GB, two replicas and Redis | 20 GB | about 8 GB per month |
Those growth figures assume compaction is running, which it is by default. Without it, storage grows forever. A snapshot adds to what it compacts instead of replacing it, and agent activity produces epoch churn on every commit.
Media takes most of the storage. Text still costs something, because one document change is one envelope with its own encryption framing.
Names and ports
- One hostname with an A or AAAA record pointing at the host, for example
relay.example.com. - Port 443 open inbound, which is where clients connect.
- Port 80 open inbound, which the bundled TLS terminator needs to complete a certificate challenge. You can close it afterwards if you take over certificate issuance yourself.
- Outbound HTTPS, unless you turn off the release check for an air-gapped install.
The private network path has no ACME, no public DNS record and no inbound port. See DNS and TLS.
Dependencies
The compose bundle brings its own Postgres, object storage, Redis and TLS terminator, so a fresh host with a container runtime is enough. The bare binary needs you to supply Postgres and a bucket or a filesystem path. Redis is optional there and needed only above one relay process.
Clients
The Mac app is the full client. It needs macOS 14 or later, it is Developer ID signed and notarized, and the same build works against a hosted relay or one you run.
The Android app is a direct client too. It joins a workspace without a Mac, creates its own device key for that workspace, and connects to the relay itself.
The iPhone companion is the third redeeming client. It redeems a workspace invite on its own, holds its own per-workspace device key and group state, and syncs over the relay. It has no git, so source code does not land in a workspace redeemed on the phone.
The Watch stays a companion to a paired Mac or phone and holds no workspace keys of its own.
There is no web client. A browser cannot hold a device key the way the apps can, and that limit is permanent.
What you do not need
You do not need Kubernetes, an account with us, a license key for the relay, or a network path from the relay to anything of ours. The relay depends on no commercial vendor. It has no billing client, no license check, no callback, and no configuration key naming one.