Relay
Relay is the self-hosted full-experience path. People log into KB-1 Cloud, but the daemon and durable vault files stay on a machine the user controls.
Use relay when the open-source daemon is not enough because people or agents need to reach the vault from somewhere other than the daemon host or a private network you already trust.
What relay does
Section titled “What relay does”- Authenticates people through KB-1 Cloud.
- Checks organization membership before entry.
- Routes browser and agent data-plane requests to the connected daemon.
- Carries presence and collaboration state through Cloud.
- Avoids inbound public ports by using an outbound daemon connection.
What relay does not do
Section titled “What relay does not do”- It does not turn a cloud-hosted org into a self-hosted org.
- It does not make Cloud the durable vault store.
- It does not remove the need to operate and back up the self-hosted machine.
- It does not make the open-source daemon itself a multi-user identity system; users and orgs still live in the Cloud layer.
Connection model
Section titled “Connection model”The daemon receives a daemon-scoped API key once and presents it as
KB1_RELAY_TOKEN:
KB1_RELAY_URL="https://api.kb-1.ai/t/<org-id>"KB1_RELAY_TOKEN="kb1_dmn_..."The daemon opens the outbound control connection. Cloud then routes authorized org traffic through that connection.
Success signal
Section titled “Success signal”On the daemon:
curl http://127.0.0.1:7382/api/relay/statusA connected relay reports relay.configured: true, relay.started: true,
and relay.controlConnected: true.