Run a Messenger Relay

A relay holds encrypted messages until the recipient collects them. It sees a mailbox number, envelope ID, rounded size and expiry time, but has no keys to decrypt users’ conversations. Relays register on chain with a stake and receive a share of the block reward. Participation in the closed testnet requires an invitation. Open participation is planned for the open-testnet stage.

What you need

• A Linux server with Docker and Docker Compose.
• Your own Morana node: the relay is installed together with it from one compose file, or connects to a node you already run. The relay reads the chain itself, not through someone else's gateway.
• A public IP address — or only an .onion address if you have no public one.
• Disk space: the relay database takes up to 50 GiB, plus room for the chain.
• XMOR for the stake and a little XMOR for the fees of its heartbeat (a regular on-chain record that the relay is working).

You do not need a domain or a certificate from a certificate authority. The relay makes its own TLS certificate, and clients check its fingerprint against the relay's record on chain. Clients do not trust system certificate authorities, and DNS plays no part in verification: a host name is only a convenience.

Keys

The relay owner key is derived from your 24-word recovery phrase. Besides it, a relay has a service key, a TLS key and an onion key. All four must be different: if any two match, the registration is rejected.

Registration and stake

1. Bring up the node and the relay and wait for the chain to sync.
2. Register the relay on chain: a relay record with the service key, a record of its address (IP and port or .onion, plus the certificate fingerprint) and a stake locked to the owner key.
3. The network computes the stake: roughly four weeks of a relay's income in the first six months, then up to fifteen weeks. It changes by at most 25% per week and never drops below 15,000 XMOR. If the computed stake goes up, you have two weeks to top up, otherwise the relay leaves the payout queue.
4. To leave, deregister the relay; the stake becomes spendable after 43,200 blocks (30 days).

Heartbeat

The relay posts its own heartbeat to the chain, signed with the service key. A small wallet on the server pays the fees; when it runs low, the relay warns you. A relay that has sent no heartbeat for more than 1,440 blocks (about a day) drops out of the payout queue by itself, without anyone's signature.

What it pays

The relay share of each block goes to one eligible relay — the one that has gone the longest without a payout. With N relays, yours receives 75 XMOR every N-th block, but no more than the weekly cap. On top of that, 80% of name registration and renewal fees goes to the swarm through the same queue.

In the first and second eras (an era is the roughly four years between halvings) the relay share is 756,000 XMOR per week for the whole swarm. Here is what that looks like without name fees:

The formula relates the stake to 4 or 15 weeks of rewards, but the minimum stake and income cap change that ratio. With 300 relays and T = 4 weeks, the minimum stake equals about 6 weeks of rewards. The actual stake requirement changes by no more than 25% per epoch. See Economics.

There is no committee deciding whom to pay. The network pays for the stake and the heartbeat, and delivery quality is checked by the apps: a relay that does not answer clients stays in the queue, but clients route around it.

How clients choose relays

For each mailbox, the app selects up to five relays. A message counts as accepted after four confirm storage. When metadata and enough alternatives are available, selection first limits each operator, provider or region to two relays; any remaining places are filled from the available relays. These choices apply to each mailbox separately.

Ports

• Only the relay's HTTPS port and SSH are open to the outside.
• The relay program listens on local port 8090 behind a reverse proxy.
• Never expose the node's RPC.

Storage limits

An envelope is up to 64 KiB, a mailbox up to 100 MiB and 5,000 envelopes, a message is kept for 14 days, an attachment of up to 8 MiB for 7 days, and the whole relay database up to 50 GiB. When full, the relay refuses new writes and keeps serving what it already holds. These limits bound relay storage. Reserve additional disk space for the chain, logs and operating system.

Operations

• Do not log client IPs. Check your reverse-proxy and relay log settings.
• Keep the server patched and SSH key-only.