Run your own relay

The relay server (nestwatch-server) and relay support in the apps are being finalized. This page describes the planned deployment so you can prepare; details such as option names may still change. The full, current guide is docs/self-hosting.md.

The server helps a listener reach a station without knowing its address, helps both open a direct connection through their routers, and forwards the encrypted stream when no direct path works. It only ever sees encrypted data: the devices' own handshake runs end to end through it. The same HTTPS address can host this website and the browser listener.

• A Linux server reachable from the internet, with a domain name
• A reverse proxy for HTTPS (nginx or Caddy) that passes WebSocket upgrades on /nwr/1
• Open firewall ports: TCP 443 (HTTPS) and UDP 3478 (address discovery for direct connections)
• One directory for state (the server keeps hashed mailbox secrets and transfer counters there); no database

• Download nestwatch-server-linux-x86_64 from the latest release (when available) and install it as /usr/local/bin/nestwatch-server.
• Create a system user and a state directory, for example /var/lib/nestwatch-server.
• Run it with systemd: it listens on a local HTTP port for the reverse proxy and directly on UDP 3478.
• Configure nginx or Caddy for your domain: forward /nwr/1 to that local port with WebSocket upgrades, and serve the static website and browser listener (nestwatch-site.tar.gz, nestwatch-web.tar.gz) for everything else.
• On each station, turn on Reachable through a relay server and enter your server's address, for example https://relay.example.org.

# Caddyfile: HTTPS certificates and WebSocket upgrades are automatic
relay.example.org {
	handle /nwr/1 {
		reverse_proxy 127.0.0.1:8480
	}
	handle {
		# static files: this website, browser listener in /app/
		root * /var/www/nestwatch
		file_server
	}
}

Configuration for nginx, the systemd unit and the firewall rules are in docs/self-hosting.md.

The server limits how much one station and one IP address can use (concurrent connections, a rate per connection and a monthly transfer budget), so one household cannot exhaust it. It logs only totals, never contents, and keeps IP addresses only as long as abuse protection needs, at most 24 hours.