gosuda/portal-relay

Set up and run a public Portal relay on any Linux host with a public IP — Docker Compose deployment, embedded authoritative DNS with one-time NS delegation, optional TCP/UDP lease ports for game hosting, and registration in the public relay pool. Use when the user asks to run their own relay, contribute a relay to the Portal network, self-host a relay instead of using public ones, or open a relay with game-server support. Do not use for exposing a local service (portal-expose), reaching a published service as a client (portal-connect), or for accessing a CLI agent remotely. Administration of a running relay is portal-relay-admin, and failure diagnosis is portal-relay-diagnose.

Operate a running Portal relay through its admin and policy API - sign in with the relay ADMIN_TOKEN without exposing it, list leases and their approval state, approve, deny, ban, or rate-limit one identity, switch approval mode between auto and manual, change UDP and TCP lease limits, and read admin metrics. Use when the user runs a Portal relay and asks to approve or deny a tunnel, ban an identity, throttle a lease, change approval mode or lease limits, or check who is connected. Do not use for first deployment (portal-relay), for failure diagnosis (portal-relay-diagnose), or for exposing an app (portal-expose).

Create an AWS host for a Portal relay - an EC2 instance with a security group and an Elastic IP, or a Lightsail instance with its public ports and a static IP - using the user's existing AWS CLI profile or IAM Identity Center sign-in, and hand the host to portal-relay for deployment. Use when the user wants to run a Portal relay on AWS, EC2, or Lightsail. Do not use for a host that already exists (portal-relay), for Route 53 as the relay's ACME DNS provider (relay configuration), or for other clouds.

Configure a Cloudflare-hosted parent zone for a Portal relay - the NS delegation of the relay subdomain to the relay's embedded DNS, the glue A/AAAA records, and the DS record for DNSSEC - with a zone-scoped API token, then verify delegation and DNSSEC from public resolvers. Use when the parent domain of a Portal relay is on Cloudflare DNS and the user wants the delegation or DS record created or checked. Do not use for hosting the relay (Cloudflare is not the VM provider here), for proxying relay traffic through Cloudflare, or for zones that are not on Cloudflare.

Find which layer of a self-hosted Portal relay is failing - container and process, open ports, embedded DNS and NS/glue delegation, DNSSEC and the parent DS, TLS and SNI routing, the QUIC UDP backhaul and TCP/UDP lease ports, or approval and source policy - with bounded read-only checks, then report the cause and the fix. Use when a relay operator says the relay, its DNS, its certificates, its tunnels, or its game ports do not work. Do not use when the user is a publisher or visitor of one tunnel (portal-expose or portal-connect), for approving or banning leases (portal-relay-admin), or for first deployment (portal-relay).

Create a Hetzner Cloud server for a Portal relay with the hcloud CLI, attach a Hetzner Cloud Firewall that opens only the relay ports, keep a stable primary IPv4, and hand the host to portal-relay for deployment. Use when the user wants to run a Portal relay on Hetzner Cloud. Do not use for a server that already exists (portal-relay), for DNS changes at Cloudflare (portal-relay-cloudflare), or for Hetzner Robot dedicated servers.

Create an Oracle Cloud Infrastructure (OCI) compute instance for a Portal relay, including Always Free Ampere A1 shapes, open the VCN and host firewall for the relay ports, attach a stable public IP, and hand the host to portal-relay for deployment. Use when the user wants to run a Portal relay on Oracle Cloud or OCI, or asks to use an Oracle free-tier VM as a relay. Do not use for a host that already exists (portal-relay), for DNS changes at Cloudflare (portal-relay-cloudflare), or for other clouds.