Config: relay_url for a self-hosted iroh relay (RelayMode::Custom)

The sovereign hole-punch hook redoal's ADR-0021 milestone 3 needs: when
relay_url is set (VARDE_RELAY_URL or the config file), the endpoint
coordinates NAT traversal through the operator's own iroh relay instead
of n0's or none — takes precedence over wan_upload's n0 defaults. None
keeps the existing LAN-only / n0 behaviour, so nothing changes by default.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitea/workflows/release.yml

@@ -36,7 +36,12 @@ jobs:
           apt-get update
           apt-get install -y --no-install-recommends scdoc jq
           if [ "${{ matrix.target }}" = "aarch64-unknown-linux-gnu" ]; then
-            apt-get install -y --no-install-recommends gcc-aarch64-linux-gnu
+            # libc6-dev-arm64-cross is a Recommends of the cross gcc, so
+            # --no-install-recommends skips it — without it cc-rs builds
+            # (blake3's NEON unit) fall back to host headers and die on
+            # bits/wordsize.h.
+            apt-get install -y --no-install-recommends \
+              gcc-aarch64-linux-gnu libc6-dev-arm64-cross
           fi
           rustup target add ${{ matrix.target }}
 
@@ -50,7 +55,9 @@ jobs:
         run: |
           VERSION="${GITHUB_REF_NAME#v}"
           PKG="varde-${VERSION}-${{ matrix.target }}"
-          mkdir -p "$PKG"/{bin,systemd/user,man}
+          # Steps run under plain `sh`, which has no brace expansion —
+          # spell the directories out.
+          mkdir -p "$PKG/bin" "$PKG/systemd/user" "$PKG/man"
           cp "target/${{ matrix.target }}/release/varde-daemon" \
              "target/${{ matrix.target }}/release/varde-ctl" "$PKG/bin/"
           # Cross-strip is unavailable for the foreign target; native

.gitignore

@@ -1,2 +1,3 @@
 target/
 .claude/
+.DS_Store

Cargo.lock

@@ -4491,7 +4491,7 @@ checksum = "ba73ea9cf16a25df0c8caa16c51acb937d5712a8429db78a3ee29d5dcacd3a65"
 
 [[package]]
 name = "varde-ctl"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "anyhow",
  "clap",
@@ -4504,7 +4504,7 @@ dependencies = [
 
 [[package]]
 name = "varde-daemon"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "anyhow",
  "iroh",
@@ -4529,7 +4529,7 @@ dependencies = [
 
 [[package]]
 name = "varde-proto"
-version = "0.1.0"
+version = "0.1.1"
 dependencies = [
  "serde",
  "serde_json",

Cargo.toml

@@ -3,7 +3,7 @@ resolver = "2"
 members = ["varde-proto", "varde-daemon", "varde-ctl"]
 
 [workspace.package]
-version = "0.1.0"
+version = "0.1.1"
 edition = "2021"
 license = "MIT OR Apache-2.0"
 repository = "https://project.uhhm.no/uhhm/varde"

varde-daemon/src/config.rs

@@ -24,6 +24,12 @@ pub struct Config {
     /// Whether any WAN (non-link-local) upload is permitted. Default off:
     /// LAN-only posture with zero WAN upload.
     pub wan_upload: bool,
+    /// A self-hosted iroh relay URL for NAT traversal. When set, the
+    /// endpoint uses this relay (`RelayMode::Custom`) instead of n0's
+    /// or none — the sovereign hole-punch coordinator an embedder runs
+    /// on its own infrastructure. Takes precedence over `wan_upload`'s
+    /// n0 defaults. `None` keeps the LAN-only / n0 behaviour.
+    pub relay_url: Option<String>,
     /// Interval of the store's built-in garbage collector in seconds.
     /// Since iroh-blobs 0.103 there is no on-demand gc; unpinned blobs
     /// are swept by this loop.
@@ -41,6 +47,7 @@ struct FileConfig {
     max_download_bytes_per_sec: Option<u64>,
     discovery: Option<bool>,
     wan_upload: Option<bool>,
+    relay_url: Option<String>,
     gc_interval_secs: Option<u64>,
 }
 
@@ -176,6 +183,10 @@ impl Config {
             wan_upload: env_bool("VARDE_WAN_UPLOAD")?
                 .or(file.wan_upload)
                 .unwrap_or(false),
+            relay_url: std::env::var("VARDE_RELAY_URL")
+                .ok()
+                .filter(|s| !s.is_empty())
+                .or(file.relay_url),
             gc_interval_secs: env_u64("VARDE_GC_INTERVAL")?
                 .or(file.gc_interval_secs)
                 .unwrap_or(300),

varde-daemon/src/transfer.rs

@@ -62,10 +62,19 @@ impl Transfer {
         metered: MeteredState,
     ) -> Result<Transfer> {
         let secret = load_or_create_secret(&config.store_dir.join("secret.key"))?;
-        // With wan_upload the n0 defaults apply (their relays and DNS
-        // lookup, matching the pre-1.0 default relay mode); otherwise the
-        // endpoint gets no external services at all.
-        let builder = if config.wan_upload {
+        // A self-hosted relay (relay_url) is the sovereign hole-punch
+        // path and takes precedence: the endpoint coordinates through
+        // the operator's own iroh relay, never n0's. Failing that,
+        // wan_upload opts into n0's relays + DNS; otherwise the endpoint
+        // gets no external services at all (LAN-only).
+        let builder = if let Some(url) = &config.relay_url {
+            let relay_url: iroh::RelayUrl = url
+                .parse()
+                .with_context(|| format!("parsing relay_url {url:?}"))?;
+            let relay_map = iroh::RelayMap::from(relay_url);
+            Endpoint::builder(iroh::endpoint::presets::Minimal)
+                .relay_mode(RelayMode::Custom(relay_map))
+        } else if config.wan_upload {
             Endpoint::builder(iroh::endpoint::presets::N0)
         } else {
             Endpoint::builder(iroh::endpoint::presets::Minimal).relay_mode(RelayMode::Disabled)