The public relay

relay.wyrdsekai.org — a door, not a home.

A relay is how your phone reaches your household when your household sits behind a home router with no public address. Zones connect out to it, phones connect in through it, and cross-household federation rides it. It is a dumb pipe: NATS routes subjects, Caddy terminates TLS, and envelopes stay signed end to end.

Running your own is three commands and stays the documented path. But needing a second machine with a public IP before your phone works is a poor first hour, so we operate one openly:

wyrd relay join relay.wyrdsekai.org   # self-serve, no invite code
wyrd relay status

When you join, wyrd shows you the relay's CA fingerprint and asks you to check it against this page — the page you are reading, served over ordinary HTTPS, is the out-of-band channel that anchors the trust decision. This relay's CA fingerprint (SHA-256) is:

8A:B8:95:8C:07:49:2B:99:46:B8:E0:4F:5B:A2:F8:7D:80:1A:3B:CF:E0:A1:EA:99:EE:BF:25:0E:47:6B:96:EC

In scripts, pass it explicitly and the join runs unattended: wyrd relay join relay.wyrdsekai.org --fingerprint 8A:B8:95:…:96:EC (full value above). If the fingerprint wyrd shows ever differs from this page, do not continue — that is the design catching someone between you and the relay.

This is a convenience, not a dependency. Nothing in the design routes through us, no account is created, and you can leave with wyrd relay leave at any time. If you would rather not trust someone else's box — a reasonable instinct for a project that argues for self-hosting — the relay bundle is a 115 KB download.

What we can see, and what we cannot

We cannot read what passes through. Envelopes are Ed25519-signed and the tunnel is encrypted end to end between your device and your household, so the relay moves bytes it cannot open. That is a property of the design, not a promise about our conduct — which is the only kind of assurance worth much.

We can see metadata, and you should assume we do. Which identity connected, when, from which network address, roughly how much traffic it moved, and which subjects were routed. A relay operator cannot avoid seeing this; anyone who tells you otherwise is describing a different protocol. If that pattern-of-life is itself sensitive to you, run your own relay.

Standing

The public relay runs in commons mode: invite-less and self-serve. Everyone starts at the bottom, and standing is per-identity.

A newcomer's vouch is worth nothing. That is the rule that stops a flood of fresh identities promoting one another: trust has to enter from someone who already has some. Two VOUCHED vouchers, or one HOUSEHOLD voucher, clears the threshold.

FLOOR is capped at 500 active registrations and pruned after 24 hours of absence; the higher tiers are uncapped and pruned after seven days.

Two limits stated plainly, because a security claim you have to squint at is worse than none. The registration cap is a hard gate — a new entrant is refused when the tier is full. The per-identity connection ceiling is detection-grade: overage is flagged to the operator rather than severed, because cutting one connection would mean dropping the identity from authentication entirely. And per-tier bandwidth limits do not exist yet — NATS throttling is account-scoped rather than per-user, so it needs a restructure we have not shipped.

Terms, in short

• Best effort, no warranty.

  It is a free service on one machine. It may be restarted, rate-limited, or withdrawn. Do not build anything you depend on around its availability — that is what your own relay is for.

• We may remove an identity.

  For abuse, for flooding, or for anything that threatens the box or the people on it. Removal is per-identity and does not touch your household, your companion, or your data — none of which live here.

• No account, no profile, no analytics.

  Joining creates a registration record — an identity key, a tier, and liveness timestamps. That is the whole of it.

The full picture, including running your own and federating two households, is in ZONES.md. Our handling of data is on the privacy page.