The Dumb Relay

The relay is infrastructure, not a service. It moves encrypted blobs from one device to another. It can’t read what’s in them, and stored blobs carry no sender identity. That’s the whole point.

TL;DR

• It’s a buffer, not a database. Blobs are deleted on delivery.
• One thing per device: an Inbox of undelivered blobs addressed to that device’s public key.
• It knows little. No content, and no sender identity on stored blobs. The Threat Model lists what it does see.
• Who runs it doesn’t change what it can read. It does decide whether your messages arrive.

What “dumb” means

A traditional sync server is smart in the worst sense. It knows your account, your devices, your data model. It can enforce permissions, resolve conflicts, answer queries. It can also read your data, hand it to a third party, or get a subpoena and produce it.

The trueseal relay had all of that taken out on purpose. It has no users and no groups. It receives blobs addressed to a public key, holds them if the recipient is offline, delivers them when the recipient connects. Everything else, it doesn’t do.

The relay is untrusted for confidentiality and integrity. It can’t read or forge your messages, whoever runs it. You trust it only to deliver them.

What the relay holds

Each device has an Inbox — a set of undelivered blobs addressed to that device’s public key. The Inbox only exists while there’s something in it. Deliver a blob and it’s gone immediately. Reconnect a device, drain its inbox, done.

Blobs that never get delivered — recipient permanently offline, lost, abandoned — get reaped after a TTL. Again: buffer, not log.

What the relay knows

It needs two things to do its job. It tracks which noise keys have active connections, so it can deliver to online devices without polling. It reads the recipient public key on each blob, so it can put the blob into the right inbox. It sees more metadata than that, but never content. The Threat Model lists what the relay sees.

Self-hosting and operator trust

Because the relay can’t read or forge your messages, who operates it doesn’t change what it can read. Your own $5 VPS or a friend’s box sees the same metadata as any other relay. The operator does decide whether your messages arrive.

The relay has its own long-term keypair. Connecting devices verify the relay’s identity through the Noise XX handshake before sending anything. The relay’s public key is distributed out-of-band by whoever runs it — baked into a client, posted on a landing page, shared as a QR. The relay doesn’t discover itself.

Always in the path

For remote sync the relay is always in the path. No peer-to-peer mode, no NAT traversal, no STUN, no TURN. Both devices connect outbound to the relay and the relay bridges them. The reasoning is in Every message goes through the relay — short version: NAT traversal over the open internet is a swamp, and “real” P2P usually falls back to a relay anyway.