Evolu Relay

Encrypted sync and backup for your local-first apps

Stored data

unknown

Last write

unknown

Waiting

unknown

Status

unknown

Accepted owners

Waiting list

Relay address

unknown

That address works inside your own network. Through a reverse proxy with a certificate it becomes wss://your.domain, without a port number: the proxy listens on 443 and forwards to this one.

About this app

What it is

Local-first apps keep your data on your own device and work whether or not you have a connection. A relay is what lets a second device catch up: it holds the encrypted changes until your other devices come online. This app runs that relay on your Umbrel, so the copy in the middle sits on hardware you own.

It is the relay from the Evolu project, taken straight from the package they publish and not reimplemented here. Any app built on Evolu can use it.

What the relay can see

Your data is encrypted on your device before it leaves. The relay holds encrypted blobs, padded so their size says nothing, and never has the key. What it can see is an owner id, which identifies data without identifying you, along with timestamps and the addresses that connect.

Self-hosting does not make the data more secret than it already is. What it changes is who keeps the encrypted copy, who can see that you are syncing at all, and whether anyone can pull the service out from under you.

Pointing an app at it

Set the address at the bottom of this page as the sync address in your app. Some apps only offer the field in their developer or advanced settings. The address has to start with http or https, not ws, even though the connection itself is a websocket: the client works that out on its own.

Away from home you will need a way in, such as Tailscale or a reverse proxy with your own domain.

Who may use it

What this app adds is the part a self-hosted relay needs and a public one does not: control over who may use it. Nobody gets in by default. An owner that connects for the first time is turned away and lands on the waiting list with its owner id, and you decide there whether it may stay. One app can use more than one owner id, so expect more than one row per device.

An owner on the waiting list syncs nothing at all, and nothing of it is stored: the relay turns the connection away before it starts. Its device keeps everything locally and retries, so allowing it later still brings the whole history across, and you do not have to be quick.

Owner ids are long and meaningless on purpose. Hover a row and use Label to give one a name of your own; the name is kept on the Umbrel and is only ever shown here.