Zrozumienie trójwarstwowej architektury tunelowej

HashRelay is a three-hop tunnel: miners speak plaintext stratum to a local client, the client and server carry that stream inside an encrypted tunnel, and the server opens the real pool connection.

Miner (plaintext Stratum)
    │  TCP to the client LAN address
    ▼
Client  ── encrypt ──►  Server  ── decrypt / route ──►  Pool
local farm              public host                    F2Pool, AntPool, …

Why three hops

• Miners stay on the LAN. They never need a public IP or a direct route to an overseas pool.
• The path between farm and server is TLS (TCP) or QUIC. Middleboxes see the tunnel, not stratum JSON.
• The server is the only host that dials the pool, so pool-side connections stay stable even when the farm's uplink is not.

What is configured where

• client.toml: server address, ports, client_id, token, certificate check, and transport preference. No miner listen ports.
• server.toml: listen ports, TLS mode, database, API, sniffing engine, alerts. No pool list.
• Database: pools and port mappings. Routing is static — listen port A always goes to pool X. There is no metadata routing, because miner firmware will not carry extra route tags.

Encryption

TCP tunnels always use TLS. QUIC uses its built-in TLS 1.3. Certificates are self-signed (default, no domain), ACME, or files. An optional frame cipher (AES-GCM or ChaCha20, frame_encrypt_alg 1 or 2) can sit on top and must match on both ends. The architecture notes that QUIC does not add a second application cipher on top of its own TLS.

Heartbeat default is 60 seconds. Three missed heartbeats (about 180 seconds) drop the session, and the client reconnects.