Docs · Operations
Put the relay on your own metal.
The stack below is production as it runs today — pinned containers, one compose file. Here is what it is, and where the public path stands.
Know what runs
The relay is a single Rust binary. Around it sit four supporting services, every image pinned by content digest — not by tag — so the stack that boots is the stack that was reviewed.
| Service | Role |
|---|---|
| qeryx-backend | The relay: REST + WebSocket, Rust |
| MixcoatlDB | Encrypted store for queued ciphertext and public keys |
| GlyconCache | Ephemeral cache for presence and rate state |
| QSFS | Encrypted file store for media blobs |
| TURN relay | Call media relay (RFC 8656) — carries encrypted media only |
Measure what an operator sees
The relay is untrusted by design, and that includes the person who runs it. An operator sees ciphertext envelopes, opaque routing identifiers, public key material, and the transparency log. Keys are born on devices; the server cannot read messages — yours or anyone's.
The full visibility ledger
Group names, subjects, avatars, and all content are end-to-end encrypted; the relay holds only opaque routing identifiers; sender identifiers are stripped from the stored message row (sealed-sender v2), though the relay still authenticates the sender at send time. Undelivered messages queue with routing metadata under a published retention ladder.
Self-hosting changes who operates the relay. It does not change what the relay can see.
Know where the path stands
The compose stack is not yet publicly downloadable, and the relay source is review-gated. Nothing on this page hands you an artifact — when it does, the link will sit here beside its SHA-384 and a signed manifest, and not before.
The self-host kit ships when the source-review program opens it. Evaluators and procurement reviewers can request source access today via procurement; the public path is roadmap, stated as roadmap.
04The operator questions — asked before you take the metal
Ask them as the operator.
Does self-hosting weaken the crypto?
No. Every session is X25519 + ML-KEM-1024 hybrid, keys never leave devices, and the safety-number ritual works identically against any relay. The protocol assumes the relay is hostile; a relay you own is just one you happen to trust anyway.
Can a self-hosted relay federate with qeryx.com?
Relay-to-relay federation exists in the tree as the Q-Echo federation modules and is not a shipped capability today. It ships when it meets the same bar as everything else here — stated in the present tense.
Why gate the kit at all?
Because a published stack is a security claim. The kit ships with a signed manifest, a hash for every artifact, and documentation that matches the bytes — the same byte-identical discipline as the client builds.