Parlane

Relay self-hosting

Direct connections need no relay at all: your server talks straight to the app over HTTPS, your LAN, or a tailnet. The relay is optional plumbing for two things a direct connection can't do on its own — push notifications, and reaching a server that's behind NAT (a home machine, a Raspberry Pi) from anywhere.

Your serverany language, any hostdirect, by defaultHTTPS / LAN / tailnetParlaneon your phoneRelay (optional, self-hostable)E2E-encrypted routing — no model, no chat contentopen source, AGPL-3.0our thin APNs / FCM gatewaypush trigger only, content-opaque

What it does

  • Your server opens a persistent outbound WebSocket to the relay — no inbound ports, no port forwarding.
  • Push: server → relay → our thin APNs/FCM gateway → the app.
  • NAT traversal: the relay is a stable address your server can reach out to from anywhere.
  • Offline queueing: messages queue while your phone is offline and deliver when it reconnects.

What it can't see

Payloads between your server and the app are end-to-end encrypted: X25519 key agreement during pairing, XChaCha20-Poly1305 for the payloads themselves. The relay sees routing metadata only — it cannot read message content, and there's no model anywhere in this path.

Self-hosting it

The relay is open source under AGPL-3.0 and ships as a single Docker container — one language (TypeScript) across the app, the relay, and the reference servers, so there's one runtime to reason about.

illustrative — final image name TBD
docker run -p 8080:8080 \
  -e RELAY_SIGNING_KEY=... \
  parlane/relay:latest

Pairing works by entering a code the app displays into your self-hosted relay's config (or an env var); keys are exchanged during pairing, and the relay stores only public routing information from then on.

The one honest limit

Apple requires our own APNs signing key to deliver push to the app, and that key can't ship inside an open-source repository. So even a self-hosted relay handles tunneling, queueing, and encryption itself, but forwards the final — already encrypted, content-opaque — push trigger through our thin hosted APNs/FCM gateway. Self-hosting buys you a private, always-reachable connection without paying us; it doesn't remove Apple's push requirement. If you don't need push, you don't need the gateway either — direct connections skip this whole path.

Hosted relay

Don't want to run your own? The hosted relay is the Pro tier — see pricing.