Docs · Operations
Put the relay on your own metal.
The stack below is the relay as designed — pinned containers, one compose file. Here is what it is, and where the public path stands.
Know what runs
The relay is a single Rust binary. Around it sit four supporting services, every image pinned by content digest — not by tag — so the stack that boots is the stack that was reviewed.
| Service | Role |
|---|---|
| qeryx-backend | The relay: REST + WebSocket, Rust |
| MixcoatlDB | Encrypted store for queued ciphertext and public keys |
| GlyconCache | Ephemeral cache for presence and rate state |
| QSFS | Encrypted file store for media blobs |
| TURN relay | Call media relay (RFC 8656) — carries encrypted media only |
Measure what an operator sees
The relay is untrusted by design, and that includes the person who runs it. An operator sees ciphertext envelopes, opaque routing identifiers, public key material, and the transparency log. Keys are born on devices; the server cannot read messages — yours or anyone's.
The full visibility ledger
Group names and descriptions and all content are end-to-end encrypted; the group avatar, the admin and owner identifiers, and the roster of accounts each conversation delivers to are held by the relay for routing. Sender identifiers are stripped from the stored message row (sealed sender), though the relay authenticates the sender at send time and keeps a per-direction pair counter for up to 180 days. Sealed sender covers text-class messages and small payloads: an image, and any voice or video frame over the envelope budget, is delivered on a lane that does name the sender to the relay for as long as the row lives. Undelivered messages queue with routing metadata under a published retention ladder.
Self-hosting changes who operates the relay. It does not change what the relay can see.
Know where the path stands
The compose stack is not yet publicly downloadable, and the relay source is review-gated. Nothing on this page hands you an artifact — when it does, the link will sit here beside its SHA-384 and a signed manifest, and not before.
The self-host kit ships when the source-review program opens it. Evaluators and security reviewers can request source access through the evaluation channel; the public path is roadmap, stated as roadmap.
04The operator questions — asked before you take the metal
Ask them as the operator.
Does self-hosting weaken the crypto?
No. Every session is X25519 + ML-KEM-1024 hybrid, keys never leave devices, and the safety-number ritual works identically against any relay. The protocol assumes the relay is hostile; a relay you own is just one you happen to trust anyway.
Can a self-hosted relay federate with qeryx.com?
Relay-to-relay federation exists in the tree as the Q-Echo federation modules and is not a capability yet. It ships when it meets the same bar as everything else here — stated in the present tense.
Why gate the kit at all?
Because a published stack is a security claim. The kit ships with a signed manifest, a hash for every artifact, and documentation that matches the bytes — the same byte-identical discipline as the client builds.