Run the relay
Last updated
Self-hosting a Weald relay takes three commands on a host you already have, plus a hostname and an open port 80 for certificate issuance. The bundle brings Postgres, object storage, Redis and TLS with it, so there is nothing to assemble. Everything below is the whole path from an empty machine to a workspace your team is working in.
Self-host when a customer contract, a residency rule or an internal policy requires project data to stay in your account, region or network. There is no email gate, no access request and no seat limit, and the relay you run is the same image the hosted tier runs.
The whole sequence
- Check the requirements: a host, a hostname, disk, and a Mac to run the client on.
- Install the relay with the three commands below.
- Set the configuration you need. Three values are required and the rest have working defaults.
- Point DNS and TLS at the host and let the bundle issue a certificate.
- Redeem the bootstrap invite and create the first workspace.
- Set up backups before you invite anyone.
- Verify the encryption claim yourself, once, so you are not taking our word for it.
The three commands
curl -fsSL https://get.weald.team/relay | sh cd weald-relay && cp .env.example .env && $EDITOR .env docker compose up -d
The first command fetches the compose bundle. The second opens the environment file, where the only value you have to set is the hostname. The third starts Postgres, object storage, Redis, the relay and a TLS terminator.
Four ways to deploy
Compose on a virtual machine is the path most self-hosters take, and it is what the three commands above do. The other three exist because a relay is a small binary and not every team wants a container on a fresh box.
| Path | Good for | What you give up |
|---|---|---|
| Compose on a VPS | Most teams, ten minutes end to end | Nothing, this is the default |
| Provider template | Railway, Fly, Render, DigitalOcean App Platform | The provider runs Postgres and the bucket, not you |
| Bare binary with systemd | Teams with existing Postgres and configuration management | TLS termination is yours to arrange |
| Private network, no public ingress | An enterprise that wants no internet exposure | ACME and public DNS, which you no longer need |
The private network path is a supported deployment, not a workaround. The relay binds to a Tailscale or WireGuard interface, clients reach it over the same network, and there is no public record and no exposure at all.
What the relay can and cannot do
A relay stores ciphertext envelopes and routing metadata. It has no key for any workspace, runs no search index, and has no admin password, no operator account and no web admin panel, because there is nothing an operator could usefully administer.
Workspace administration happens in the client, signed by a device that holds the right to admit members. An operator who is not a workspace member cannot add one, read one, or see who they are.
After it is running
Keeping it healthy is Operate, which covers the health endpoints worth alerting on and the numbers that mean capacity rather than people. Moving between versions is Upgrades, which is done by digest and not by tag. When something is wrong, Troubleshooting lists the failures this bundle actually produces.
Leaving is the same shape as arriving. Take a backup, restore it somewhere else, repoint the client. There is no export format and no data liberation feature, because there is nothing held here that your own devices do not already have.