What you need
Last updated
A Weald relay needs one small host, a hostname pointed at it, ports 443 and 80 reachable, and disk that grows with your workspace rather than with your team. A thirty-person workspace with a dozen agents fits on one virtual CPU and a gigabyte of memory. Everything below is what to check before you run the install.
The host
The relay is a small binary. What it needs is decided by how much history a workspace accumulates, not by how many people are in it, because every member device holds a full copy and the relay is store and forward between them.
| Team size | Instance | Postgres | Storage growth |
|---|---|---|---|
| 3 to 10 | 1 vCPU, 512 MB | 1 GB | about 400 MB per month |
| 10 to 30 | 1 vCPU, 1 GB | 5 GB | about 2 GB per month |
| 30 to 100 | 2 vCPU, 2 GB, two replicas and Redis | 20 GB | about 8 GB per month |
Those growth figures assume compaction is running, which it is by default. Without it, storage grows forever: a snapshot is additive rather than replacing what it compacts, and agent activity produces epoch churn on every commit.
Media dominates storage. Text is small but not free, because one document change is one envelope with its own encryption framing around it.
Names and ports
- One hostname with an A or AAAA record pointing at the host, for example
relay.example.com. - Port 443 open inbound, which is where clients connect.
- Port 80 open inbound, which is what the bundled TLS terminator needs to complete a certificate challenge. It can be closed again afterwards only if you take over certificate issuance yourself.
- Outbound HTTPS, unless you turn off the release check for an air-gapped install.
On the private network path there is no ACME, no public DNS record and no inbound port at all. See DNS and TLS.
Dependencies
The compose bundle brings its own Postgres, object storage, Redis and TLS terminator, so a fresh host with a container runtime is enough. If you are running the bare binary instead, you supply Postgres and a bucket or a filesystem path, and Redis is optional and only needed above one relay process.
Clients
The Weald client is a native Mac app. It needs macOS 14 or later, it is Developer ID signed and notarized, and it is the same build against a hosted relay or one you run.
There is no web client. A member without a Mac cannot join a workspace, and that is a real limit rather than a temporary one: a browser cannot hold a device key the way the app can, and the options for changing that are open questions rather than a roadmap.
The iPhone and Watch companions pair to a Mac over the local network and are not a way to join a workspace without one.
What you do not need
You do not need Kubernetes, an account with us, a license key for the relay, or a network path from the relay to anything of ours. The relay has no dependency on any commercial vendor: no billing client, no license check, no callback, and no configuration key naming one.