Deployment

Production deployment guide for the HashRelay server and client.

Server — Recommended Specs

Server — One-Line Install (Recommended)

The installer downloads hr-server, writes /etc/hash-relay/server.toml, installs the web UI to /usr/share/hash-relay/web, and registers a service (systemd, or procd on OpenWrt).

# Interactive install (prompts for ports, database URL, JWT secret)
# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-server.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'

# Non-interactive (override defaults via env vars)
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-server.sh | \
  env \
    TCP_PORT=8555 \
    QUIC_PORT=9555 \
    API_PORT=8080 \
    sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo env "TCP_PORT=$TCP_PORT" "QUIC_PORT=$QUIC_PORT" "API_PORT=$API_PORT" sh; fi'

Managing the systemd Service

The installer creates and enables a hash-relay-serverservice running as the hashrelay user with ExecStart=/usr/local/bin/hr-server --config /etc/hash-relay/server.toml.

sudo systemctl status hash-relay-server
sudo systemctl restart hash-relay-server
sudo journalctl -u hash-relay-server -f

Updating

# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
# Server
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/update-server.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'
# Client
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/update-client.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'
# Web admin UI
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/update-web.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'

Client — Linux

Create a client node on the server first (Web UI → Client Nodes). Replace every YOUR_* placeholder below:

# Create a client node on the server first (Web UI → Client Nodes).
# Replace YOUR_* values below with your own before running.
# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.

curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-client.sh | \
  env \
    SERVER_ADDR=YOUR_SERVER_IP \
    TCP_PORT=8555 \
    QUIC_PORT=9555 \
    CLIENT_ID=YOUR_CLIENT_ID \
    TOKEN=YOUR_ACCESS_TOKEN \
    sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo env "SERVER_ADDR=$SERVER_ADDR" "TCP_PORT=$TCP_PORT" "QUIC_PORT=$QUIC_PORT" "CLIENT_ID=$CLIENT_ID" "TOKEN=$TOKEN" sh; fi'

Or install interactively (the script prompts for each value):

# Interactive install — the script prompts for each value.
# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-client.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'

Or install first, edit config, then restart:

# Install first, edit config, then restart.
# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/install-client.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'

# Edit /etc/hash-relay/client.toml — set server_addr, tcp_port, quic_port, client_id, token
#   Linux: sudo nano /etc/hash-relay/client.toml
#   OpenWrt / already root: vi /etc/hash-relay/client.toml

# Restart — Linux (systemd):
#   sudo systemctl restart hash-relay-client
# Restart — OpenWrt (procd):
#   /etc/init.d/hash-relay-client restart

sudo systemctl status hash-relay-client
sudo journalctl -u hash-relay-client -f

Client — Windows

# Download hr-client.exe from the Downloads page, then run with your config
.\hr-client.exe --config client.toml

File Locations

Firewall Rules

# Server: allow inbound
ufw allow 8555/tcp   # tunnel (TCP/TLS)
ufw allow 9555/udp   # tunnel (QUIC)
ufw allow 8080/tcp   # admin API + web UI (restrict in production)

Uninstall

# Already root (OpenWrt / iStoreOS): runs directly. Other Linux: uses sudo.
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/uninstall-server.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'
curl -fsSL https://downloads.hashrelay.net/hashrelay/scripts/uninstall-client.sh | sh -c 'if [ "$(id -u)" -eq 0 ]; then exec sh; else exec sudo sh; fi'