Module relay 

Self-hosted relay: reaching a device that dialled out to you.

The relay is the alternative to a third-party tunnel. A device opens one outbound WebSocket to it — no inbound port, no NAT configuration — and the relay routes public traffic back down that connection.

It runs from the same binary (shell-tunnel relay), so an operator never has to match versions between two programs.

What the relay deliberately does not do: interpret capability tokens. Enrollment decides which devices may attach; the capability token in each proxied request stays end-to-end between client and device. The relay is a router, not a second security boundary.

Re-exports

pub use registry::DeviceRegistry as Registry;

pub use registry::POOL_TARGET;

Modules

protocol

Wire protocol between a device and a relay.

proxy

Forwarding public requests down a device’s data connection.

registry

Which devices are attached, and the idle connections that reach them.

Structs

RelayConfig

Relay server settings.

RelayState

Shared relay state.

Constants

HEARTBEAT_TIMEOUT

How long a device may go without a heartbeat before it is considered gone.

Functions

public_base_port_hint

The corrected --public-base to suggest when the stated base implies a port nobody is listening on.

relay_router

Build the relay router.

serve_relay

Run the relay server until shutdown.