Install your own relay — Docker, Linux or Windows Server

What it is for

With your own relay, all connections run through your server instead of browserdesk.de. There are three ways: Docker, Linux without Docker, and Windows Server with an MSI. Each way brings its own database (PostgreSQL). This page tells you which way fits, what to settle beforehand and what to do after the installation. The commands themselves are in the KB articles.

What you need

• A server, depending on the way: - Docker: a Linux server with Docker and Compose v2 (amd64 or arm64). - Linux without Docker: Ubuntu 22.04 or 24.04 or Debian 12 (x86_64) and root access. - Windows: Windows Server 2019 or newer and administrator rights. Windows 10/11 works for testing.
• A name under which devices and browsers reach the server, for example relay.company.com, and a TLS certificate for that name (for example from Let's Encrypt as a PFX file).
• Open ports inbound: 9013/tcp (devices, console and web access), 3478/udp (TURN) and 5349/tcp (TURN over TLS).
• A licence if the relay is to run for business longer than 30 days or with more than two devices (A5).

How to do it

1. Choose a way and install

2. Sign in for the first time

1. Read the start password from the file admin-password.txt: - Docker: browserdesk-relay/data/admin-password.txt (the first start takes about a minute), - Linux: /var/lib/triline/BrowserDesk/Relay/admin-password.txt, - Windows: %ProgramData%\Triline\BrowserDesk\Relay\admin-password.txt.
2. Open the console: https://<your-server>:9013/admin/. A Windows relay without a certificate is first reached at http://<your-server>:9013/admin/. With a self-signed certificate the browser shows a warning.
3. Leave the user name empty, enter the start password and sign in. This is the relay's emergency sign-in.
4. Right afterwards, create a named account with a second factor and work with it from then on (B4).

3. Set up name and certificate

• Windows: Settings → TLS certificate → choose a certificate from the Windows store → Bind. It takes effect after a relay restart.
• Linux and Docker: Settings → Configuration → section TLS certificate: enter the path of the PFX file and its password, then Save & restart relay (B3).
• Choose an RSA certificate with the “ISRG Root X1” chain. Otherwise the desktop programs fail to connect without a visible message.

4. Make it reachable from outside

1. Open the ports from “What you need” in the firewall. The Windows MSI creates the rules itself.
2. In Settings → Configuration → STUN and TURN, enter the Public IP if the relay sits behind address translation (NAT). Left empty, the relay finds it at start-up. With Docker, also put the address as PUBLIC_IP into the .env file.
3. If your firewall only allows individual ports (typical for cloud servers), set Relay ports from and Relay ports to in the same section and open that UDP range too. With 0 the operating system picks the ports.

5. Licence, accesses, devices

1. Install the licence: A5.
2. Create an access for your devices: Tenants → New tenant. In the console an access is called a tenant.
3. Switch the devices to your relay (C6) and add them to the access (C2, many at once: C3).

How you know it worked

• https://<your-server>:9013/health answers with "ok":true and the relay's version.
• You can sign in to the console; Settings → Relay status shows the version.
• A device with your relay's address appears under Devices.

Good to know

• Without a licence a new relay runs for 30 days with up to five devices, then permanently with the two devices registered first — for private use only.
• Port 443: browserdesk.de bundles everything on port 443. Your relay listens on 9013 by default. You change the port in Configuration → Server → Port (for the MSI with PORT=…). The STUN and TURN section also has the option Multiplex turns: onto the relay's own TLS port. There is no tested guide for running your own relay on 443 yet — write to info@browserdesk.de.
• No TLS proxy in front. The relay evaluates the real peer address, never a header such as X-Forwarded-For. Behind a reverse proxy that terminates TLS, sign-in throttles and trusted networks only see the proxy (B9).
• Back up the key: Docker writes a value BD_KEYRING_KEY into .env. Without it, all secrets stored in encrypted form are unreadable — keep it separately from the server (B9).
• Backup: with Docker, the data/ folder; on Linux /var/lib/triline/BrowserDesk/Relay plus pg_dump browserdesk; on Windows %ProgramData%\Triline\BrowserDesk\Relay. More in B8.
• Uninstalling on Windows removes both services but keeps the data under %ProgramData%\Triline\BrowserDesk\Relay.
• Updates: B8. Hardening: B9. Changing settings: B3.

If it does not work