The relay is how customer-owned data joins the mesh without opening inbound access. The customer runs the hebrah-relay binary next to their database; it registers with the control plane, receives an mTLS certificate, and opens a single outbound tunnel. Agent queries flow through the control plane into the relay, which speaks the Postgres wire protocol locally — scopes are enforced before any statement runs.
Enroll (CLI)
hebrah relay enroll --target postgresql://user:pass@localhost:5432/appdb \
--scopes table:orders,period:2025-Q4
# → relay_id + one-time enrollment token
hebrah relay list [--all] # your relays
hebrah relay status <relay_id> # health, cert expiry, heartbeat age
hebrah relay revoke <relay_id> --reason "offboarding" [--yes]Under the hood
- Enrollment:
POST /v1/relays/enroll-tokenissues a one-time JWT;POST /v1/relays/registerexchanges it for a per-relay mTLS client certificate minted by step-ca. - Outbound only: the relay dials out to the control plane. No inbound firewall holes, no VPN, no exposed ports.
- Wire protocol: the relay proxies the Postgres wire protocol (simple and extended) locally — scopes are enforced before any statement reaches the database.
- Identity: certificates renew automatically (
POST /v1/relays/{relay_id}/renew) or rotate on demand (/rotate-cert). Revoking (DELETE /v1/relays/{relay_id}) cuts access instantly. - Evidence: hash-chained heartbeats and audit events stream back to the control plane. Tamper with a row anywhere in the chain and the verify call fails.
Relay endpoints
| Endpoint | Purpose |
|---|---|
| POST /v1/relays/enroll-token | Mint a one-time enrollment JWT |
| POST /v1/relays/register | Exchange the JWT for an mTLS certificate |
| GET /v1/relays | List your relays with health + heartbeat age |
| POST /v1/relays/{relay_id}/renew | Renew the mTLS certificate |
| POST /v1/relays/{relay_id}/rotate-cert | Force a certificate rotation |
| DELETE /v1/relays/{relay_id} | Revoke the relay instantly |
When to use a relay vs. a demo target
- Demo targets (12 across 6 packs): Hebrah hosts the data — connect straight from a $1 trial.
- Relay: the data lives in your Postgres. Enroll it, and the same scoped-connection + audit model applies to production data without it ever being exposed inbound.
Production SaaS accounts (like Stripe) use credential kind instead: connect a read-only restricted key in the dashboard — see Connectors.