Self-host Dropt relay

Start with Docker

The relay service in the repo builds and runs with Docker. For production, use your own random tokens — never reuse the sample values.

docker build -t mycel-dropt-relay ./dropt-relay
docker run --rm -p 8787:8787 \
  -e DROPT_RELAY_WRITE_TOKEN="replace-with-random-write-token" \
  -e DROPT_RELAY_DRAIN_TOKEN="replace-with-random-drain-token" \
  mycel-dropt-relay

Token roles

• DROPT_RELAY_WRITE_TOKEN: phone clients use this to write encrypted messages.
• DROPT_RELAY_DRAIN_TOKEN: the desktop app uses this to fetch and delete messages.

These tokens are relay access control, not decryption keys. Do not commit them to a public repo or leave them in screenshots.

nginx reverse-proxy example

server {
  server_name relay.example.com;

  location / {
    proxy_pass http://127.0.0.1:8787;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}

Security boundary

• Relay stores encrypted payloads and queue metadata only.
• After a successful desktop drain, relay deletes the matching queue item.
• If relay is exposed to the public internet, use HTTPS and keep tokens in server environment variables.
• If a token leaks, rotate it immediately and restart the service.

Connect Mycel

In desktop phone-capture or Dropt settings, enter the relay URL and tokens. After the phone submits through the pairing page or share path, the desktop drains the relay and writes into the local vault.