Private relays
A private relay is a relay that you run on your own server. It serves only the tunnels of your account.
What it is
You start Takelan's relay program (the satellite) on a server you control, enroll it with a one-time token and assign your tunnels to it. Visitors then reach your tunnel through your own relay.
Start with Takelan's infrastructure, or bring your own, and pay one predictable platform subscription either way.
What runs where
| On your server | At Takelan | |
|---|---|---|
| Relay and TLS | The relay program ends TLS for your tunnels and carries the traffic | Nothing in the path of the traffic |
| Certificates | The private key is created and stays here | Orders and renews the certificate centrally and hands the certificate (not the key) to your relay |
| Names and routing | Serves the hostnames in its signed configuration | Issues names, keeps the signed configuration and DNS up to date |
| Your app | Runs next to your client | Never |
Certificates
Certificates are managed centrally by Takelan so that your relay never needs DNS or ACME credentials. The relay makes the request with its own key; the signed certificate comes back. Visitors can use a tunnel once its certificate exists, and renewals start before the old certificate expires.
Isolation
- Only tunnels of the owning account can be assigned to a private relay. Other accounts cannot assign it, reach it or see it.
- The configuration a relay receives is signed and contains only its owner's tunnels.
- The relay serves only the hostnames in that configuration.
What Takelan sees and does not see
For a tunnel served only by private relays, Takelan does not decrypt the traffic, so it cannot read requests or answers.
- Takelan keeps: your account, your tunnel and relay settings, the audit log, the traffic totals the relay reports and the relay's health.
- Takelan does not have: the payload, your private key.
- Features that need to read the traffic, such as the cache (CDN) and the server-side request inspector, are not available for such a tunnel.
Setup in short
- In the dashboard, open My relays and add a private relay: name, region and its public addresses.
- Copy the one-time enrollment token (valid for 24 hours) and the start commands that the dashboard shows.
- Start the relay on your server. It enrolls, and Takelan publishes its name.
- Assign your tunnels to it. When its certificate is ready, visitors are served by your relay.
You can disable, re-enable or delete a relay yourself and watch its traffic and any anomalies in the dashboard.
Hosted relay or private relay
Takelan-hosted relay
- Traffic goes through Takelan infrastructure.
- Your plan's bandwidth and request allowance applies.
- You get warnings at 80% and 95% of the allowance.
- Hosted traffic is paused at the limit unless you upgrade.
- There are no automatic overage charges.
Customer-hosted private relay
- Traffic goes straight through your own relay.
- Payload bandwidth does not count toward Takelan's hosted allowance.
- The subscription pays for management, domain and certificate automation, routing configuration, security and platform services.
- Reasonable platform API, abuse-prevention and support limits still apply.
Start with Takelan's infrastructure, or bring your own, and pay one predictable platform subscription either way.