Configuration

Every value lives in your profile's cordis.patch.yml under the relay row. Your layer applies after the bundle's, so it wins. A patch replaces the row's whole config, so restate every key you want — including stateDir, which has no default.

- id: relay
  name: 'dsh-relay'
  config:
    bind: '0.0.0.0'
    port: 3443
    stateDir: !!js dshHomePath('relay')
    tls: 'files'
    tlsCertPath: '/path/to/fullchain.pem'
    tlsKeyPath: '/path/to/privkey.pem'
    publicHostnames: ['relay.example.com']
    privilegedMethods: 'allow-authenticated'
    compat:
      addressGrants: true
      addressGrantTtlMs: 86400000
      plainPort: 3444

Field	Default	What it decides
`bind` / `port`	`0.0.0.0` / `3443`	The primary listener.
`tls`	`self-signed`	`files` for a certificate a browser trusts, `self-signed` for pinning clients, `off` for plaintext.
`publicHostnames`	`[]`	Extra names this relay is reached by — certificate SANs, and accepted `Host` values.
`trustedHosts`	`[]`	Additional authorities the fence accepts, as bare `host` or `host:port`.
`auth`	`both`	Which credential classes are accepted.
`sessionTtlMs`	12 h	Browser cookie lifetime.
`deviceTokenTtlMs`	30 d	Device token lifetime.
`pairingWindowMs`	5 min	How long a pairing code stays claimable.
`maxFailedAttempts` / `lockoutMs`	5 / 15 min	Sign-in lockout.
`rateLimitPerMinute`	600	Per-address request ceiling.
`privilegedMethods`	`allow-authenticated`	Whether an authenticated remote client reaches settings, credentials, model discovery, and host pickers. Address-granted clients never do, regardless.
`extraProxyPaths`	`[]`	Additional path prefixes a write may address.
`compat.addressGrants`	`true`	The DSH Mobile 0.5.0 bridge described above.
`compat.plainPort`	`0`	Plain-HTTP listener for clients that cannot use TLS.
`uiLink`	`true`	Add the Relay link to the harness web UI.
`mdns`	`true`	Advertise `_dsh._tcp`.

Per-invocation overrides

There are no --relay-* flags, and there cannot be. The harness's web app owns the invocation's parser and rejects any option it does not declare, so a flag added by a bundle fails dsh web before any plugin loads. The shipped patch reads the environment instead:

Variable	Effect
`DSH_RELAY_PORT`	primary listener port
`DSH_RELAY_BIND`	listen address
`DSH_RELAY_TLS`	`self-signed`, `files`, or `off`
`DSH_RELAY_PLAIN_PORT`	plain-HTTP listener port; `0` disables it
`DSH_RELAY_DISABLE=1`	skip the relay entirely this run

DSH_RELAY_PLAIN_PORT=3444 dsh web

dsh-relay

安装

说明文档

Configuration

Per-invocation overrides