VaultMesh relay helps trusted devices reach each other across networks while forwarding encrypted payloads only.
VaultMesh devices sync directly on local network whenever possible. When devices are on different networks, relay provides rendezvous and forwarding for encrypted sync traffic.
Privacy model: relay transport is untrusted. Clients enforce protocol compatibility with header X-VaultMesh-Protocol: 3. Relay operators cannot decrypt vault plaintext.
# Linux or macOS example tar -xzf vaultmesh-relay-v1.1.9-linux-x64.tar.gz cd vaultmesh-relay-v1.1.9-linux-x64 chmod +x vaultmesh-relay # Start relay on port 3030 ./vaultmesh-relay --listen 0.0.0.0:3030 --db relay.db # For production, put TLS in front with nginx, Caddy, or another reverse proxy. # VaultMesh clients should use the public https:// relay URL.
| Component | Requirement |
|---|---|
| OS | Linux (x86_64 or arm64), macOS, or Windows Server |
| RAM | 64 MB minimum |
| Disk | Less than 30 MB for binary and logs |
| Network | Public domain or static IP with inbound TCP port |
| TLS | Terminate HTTPS with a reverse proxy for production deployments |
Configure relay using CLI flags.
| Flag | Default | Description |
|---|---|---|
--listen | 0.0.0.0:3030 | HTTP API listen address |
--db | relay.db | SQLite database path for persistent storage |
--mode | store-and-forward | Relay mode: persistent store-and-forward or stateless |
--ttl-hours | 72 | Message TTL in hours |
--max-buffer | 10485760 | Maximum buffer size per vault in bytes |
--p2p-port | 4001 | libp2p Circuit Relay listen port; use 0 to disable |
https://relay.yourdomain.com.Important: Production deployments should use https:// with TLS. Plain http:// is for localhost testing only.
# /etc/systemd/system/vaultmesh-relay.service
[Unit]
Description=VaultMesh Relay Server
After=network.target
[Service]
Type=simple
User=vaultmesh-relay
ExecStart=/usr/local/bin/vaultmesh-relay --listen 0.0.0.0:3030 --db /var/lib/vaultmesh-relay/relay.db
Restart=on-failure
RestartSec=5
NoNewPrivileges=true
PrivateTmp=true
[Install]
WantedBy=multi-user.target
sudo systemctl daemon-reload sudo systemctl enable --now vaultmesh-relay sudo systemctl status vaultmesh-relay
GET /health
{
"status": "ok",
"protocol": "vaultmesh-relay-3",
"mode": "store-and-forward",
"buffering": "enabled"
}
Note: Relay is a sync transport component, not a VPN or generic proxy. Keep deployment access controls aligned with your policy.
For deployment help, contact vaultmesh.support@gmail.com. Include relay version, command flags, and log snippets.