nanami-0713/relay-kit

relay-kit is a self-hostable relay server for reaching a service on your desktop from a phone over the public internet. It targets people who want a personal tunnel without handing plaintext to the relay operator: the relay only sees ciphertext and a routing token, with decryption happening at the two ends. The server runs on Cloudflare Workers and Durable Objects, and the repository also ships reference agent and client implementations so the server can be used and tested immediately.

What it does and how it works

The relay sits between a phone and a desktop agent. The agent makes an outbound WebSocket connection to the relay and forwards HTTP/WS frames to a local port such as 127.0.0.1:3425; the client on the phone completes an end-to-end handshake and then issues fetch() and WebSocket() calls through the tunnel. A single 256-bit pairing code serves as both the routing-token derivation salt and the PAKE salt, so the code is the full authority for pairing.

Each pairing is one hibernating Durable Object built on the WebSocket Hibernation API, which the author says makes idle but connected pairings cost approximately zero GB-s. The core package uses only WebCrypto with zero dependencies, so the same code runs on Node, browsers and Capacitor WebViews.

Ways to run it

The main path is deploying the Worker to your own Cloudflare account with wrangler deploy; the author describes no build step, no config to fill in and no database to create, and says a 24/7 agent plus occasional phone use fits in the free tier. The repository also includes a protocol-identical Node relay fixture that can serve as a single-process self-hosting alternative and as the basis for local tests. The npm packages ship compiled ESM for Node ≥ 18, while the in-repo test suite imports TypeScript directly and needs Node ≥ 23.

Constraints that matter

• Not wire-compatible with official Alma clients: the protocol was distilled from Alma's relay, but the protocol string differs, so official Alma clients cannot connect out of the box.
• The handshake is not audited: the author describes it as homegrown, transcript-bound and constant-time where it matters, but not formally verified, and recommends certified crypto if that is required.
• The relay operator has residual power: it can deny, delay or close traffic, and it can observe message sizes and timing. Rooms are keyed by sha256(routingToken), and a leaked routing token allows denial of service, not decryption. No rate limiting or abuse controls ship, so a relay shared with others should be fronted by WAF rules.
• Network reachability: *.workers.dev is described as SNI-blocked on many mainland China networks; the agent accepts --proxy or HTTPS_PROXY, and binding a custom domain on the same Cloudflare account is suggested for long-term phone use.
• Uploads are single-frame today; request-body chunking is listed as not yet implemented.

The project has been deployed on Cloudflare Workers and verified end-to-end from a real phone according to the author's status list, with the real Worker exercised in CI. It is MIT licensed. The repository was created on 2026-10-30; the supplied board observation is a single NEW-REPOSITORY listing from 2026-10-31 with 104 total stars, which is not a daily growth measurement and does not establish a trend.

Project source and documentation