Skip to main content

Self-Hosted Relays

A self-hosted relay sits inside your network and routes agent traffic to TridentStack Control. Agents connect to the relay over your local network, and the relay maintains a single encrypted connection upstream to the TridentStack gateway.

When to use a relay​

  • Firewalled networks - endpoints cannot reach the internet directly, but a designated server can.
  • Bandwidth optimization - a single multiplexed connection replaces many individual agent connections.
  • Compliance - traffic stays on your network until it reaches a server you control.

How it works​

Agents (LAN) --> Relay (your server) --> TridentStack Gateway (cloud)

Each relay generates its own TLS certificate authority. Agents connecting through a relay verify the relay's certificate using a fingerprint you provide during agent installation. All traffic between agents and the relay is encrypted.

Requirements​

  • A Linux or Windows server (or Docker host) with outbound internet access to gateway.tridentstack.com:443
  • Agents need LAN access to the relay on port 50051 (gRPC) and port 8080 (certificate bootstrap)
  • The relay binary is approximately 15 MB

Limitations​

  • Relay-to-relay chaining is not supported
  • Each relay operates independently; there is no automatic failover between relays