Self-host remux-relay (free)

Run the same relay binary we use for official nodes on your VPS. Non-official hosts are never billed. Frames stay end-to-end encrypted; the relay only forwards ciphertext.

Requirements

Linux VPS (x86_64, glibc ≥ 2.35 recommended)
A domain name (e.g. relay.example.com) with DNS A/AAAA to the VPS
Ports 80/443 open (for TLS + WebSocket)

1. Download binary

Linux x86_64 build (glibc ≤ 2.35 — runs on Ubuntu 22.04+):

remux-relay-linux-x86_64 — sha256

curl -fsSL -o remux-relay https://remux.eds-on.life/downloads/remux-relay-linux-x86_64
curl -fsSL -o remux-relay.sha256 https://remux.eds-on.life/downloads/remux-relay-linux-x86_64.sha256
sha256sum -c remux-relay.sha256
sudo install -m 0755 remux-relay /opt/remux-relay
sudo useradd --system --no-create-home remux || true

2. systemd unit

Listen on loopback only; put nginx or Caddy in front for TLS. Health stays on 127.0.0.1:9878 — do not publish it.

[Unit]
Description=Remux self-hosted relay
After=network.target

[Service]
Type=simple
ExecStart=/opt/remux-relay 127.0.0.1:9877
Restart=on-failure
RestartSec=3
User=remux
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target

sudo systemctl enable --now remux-relay
curl -sS http://127.0.0.1:9878/health

3. TLS reverse proxy

Caddy

relay.example.com {
  reverse_proxy 127.0.0.1:9877
}

nginx

WebSocket upgrade on / (and optional /ws) to http://127.0.0.1:9877, TLS via Let’s Encrypt, long proxy_*_timeout (≥ 300s). Prefer the full reference in the repo: docs/deployment/relay-nginx.conf + camouflage page docs/deployment/relay-public/. Do not expose metrics port 9878 publicly.

# firewall
sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw --force enable

4. Point the Agent at your relay

On the desktop Agent, set relay_url = "wss://relay.example.com" in config.toml (or env REMUX_RELAY_URL). Official NAT entitlement is not required for self-host.
Restart Agent. Tray QR becomes a relay QR with your host.
Phone App: scan that QR. Connection card shows your host (self-hosted path — never official Remux_NAT branding).

5. Verify

systemctl is-active remux-relay → active; curl http://127.0.0.1:9878/health ok.
Agent log/tray: tunnel started (no official entitlement needed).
App scan → match → window list works.
Browser https://relay.example.com/ may show a simple page; WSS upgrade is what matters.

You operate the VPS and domain. Keep the binary updated. Official remuxnat*.eds-on.life remains a separate paid/trial product. Longer ops notes: repo docs/deployment/self-host-remux-relay.md.