Relay

Ordyn Relay is a transport service used by Intel AMT KVM and SOL sessions and Microsoft Hyper-V console sessions. Relay is managed under Services > Relay.

Components and network requirements

Each deployment requires:

• an Edge service
• a public HTTPS/WSS address and valid TLS certificate for the Relay service

Source	Destination	Port and protocol	Purpose
Browser	Relay service	WSS TCP 443	Intel AMT or Hyper-V console data
AMT client	Relay service	WSS TCP 443	KVM or SOL device-side data
Hyper-V host Agent	Relay service	WSS TCP 443	Hyper-V console device-side data
Relay service	Assigned Edge	WSS TCP 443	Enrollment, control, and runtime configuration
Relay service	Redis	TCP 6379 by default	Shared authorization and capacity state

The browser and the participating AMT client or Hyper-V host Agent initiate WSS connections to the selected Relay service. Relay requires public inbound HTTPS/WSS access and connects outbound to Edge.

Add the public HTTPS origin of every Relay service to the frontend's relayOrigins array in config.json. This permits browsers to open Relay sessions under the frontend's content security policy. Restart the frontend container after changing the array.

Installation

Prerequisites:

• Docker installation
• Cosign installation
• Traefik installation
• public DNS for the Relay hostname

Open Services > Relay, select Add Relay service client, and configure:

• a unique name
• the assigned Edge service
• the public HTTPS/WSS base URL

Copy the created Relay service client ID.

Checkout the Relay deployment folder from the Ordyn compose repository:

if [ ! -d /opt/ordyn-compose/.git ]; then
  git clone --filter=blob:none --sparse https://github.com/ordyn-project/compose.git /opt/ordyn-compose
fi
cd /opt/ordyn-compose
git sparse-checkout add relay

Create the environment file:

cd /opt/ordyn-compose/relay
cp .env.example .env

Set these values in .env:

SERVICE_DOMAIN=ordyn-relay.example.com
ORDYN_RELAY_EDGE_HOST=ordyn-edge.example.com
ORDYN_RELAY_SERVICE_CLIENT_ID=<service-client-id>

SERVICE_DOMAIN must resolve to the Traefik host. Use the corresponding URL, such as https://ordyn-relay.example.com, as the service client's public HTTPS/WSS base URL.

Pull and verify the service image:

docker compose pull
python3 /opt/cosign-docker-verify/verify.py

Continue only when the Relay image verifies successfully and no failed verification message appears. Open Administration > Enrollment Tokens, choose Service client and Relay, and select the same Edge service and Relay service client. Relay enrollment is global and does not use a tenant. Copy the one-time token, stop any running Relay container, and enroll the persistent service state:

docker compose stop relay
printf '%s' '<enrollment-token>' | docker compose run --rm -T --no-deps relay npm run enroll -- --token-stdin

After enrollment succeeds, start Relay and its required services:

docker compose up -d relay

To renew, recover, or replace the Relay service-client certificate, issue a new token and run forced enrollment while Relay is stopped:

docker compose stop relay
printf '%s' '<enrollment-token>' | docker compose run --rm -T --no-deps relay npm run enroll -- --token-stdin --force

Run docker compose up -d relay only after forced enrollment succeeds. Do not use docker compose exec for enrollment.

Add the Relay origin to the frontend config.json, then restart the frontend. For example:

{
  "relayOrigins": ["https://ordyn-relay.example.com"]
}

Session behavior

Configure Relay routing from the Service routing action on a tenant or endpoint folder. Users with Relay view permission can inspect direct and inherited routing. Users with Relay management permission can assign multiple Relay service clients at one scope.

For each new Intel AMT KVM, Intel AMT SOL, or Hyper-V console session, Ordyn resolves Relay assignments in this order:

1. the endpoint's nearest folder with Relay assignments
2. the tenant's Relay assignments

At least one Relay service client must be assigned to the endpoint's folder hierarchy or tenant. Without an effective assignment, Intel AMT KVM and SOL and Hyper-V console sessions are unavailable.

All Relay service clients assigned at the selected scope are candidates. Ordyn selects one that is active, connected, not draining, compatible with the requested session, and below its channel capacity. If none can accept the session, the session fails without falling back to another assignment scope.

Routing changes apply to sessions started after the change. An active session remains connected to its selected Relay service client until that session ends.

Ordyn issues a short-lived, Relay-specific grant when a session starts.

Relay keeps live session payload only in process memory. It does not persist sensitive session data.

Operations and retirement

Ordyn blocks deletion of a Relay service client while sessions or other records still reference it. Drain the service client, terminate or let sessions expire, and then remove it.

See Intel AMT Infrastructure, Intel AMT Endpoint Management, and Microsoft Hyper-V VMs for the workflows that use Relay.