@openchambery/relay-server 1.19.0-beta.4 → 1.19.0-beta.41

package/DOCUMENTATION.md

@@ -1,6 +1,6 @@
 # Relay Server Package Documentation
 
-`packages/relay-server/` owns the self-hosted Layer 1 Relay server, the `openchamber-relay` CLI, and the package release and deployment contract.
+`packages/relay-server/` owns the self-hosted Layer 1 Relay server, the isolated Push Relay process, the `openchamber-relay` and `openchamber-push-relay` CLIs, and the package release and deployment contract.
 
 ## Purpose and security boundary
 
@@ -12,6 +12,8 @@ Relay v1 admission accepts anonymous Client route requests. Per-IP, global, pend
 
 The Relay keeps process-local routing state only. Hosts reconnect after Relay restarts, and a control disconnect retains its Host route for the 30-second grace period.
 
+Layer 1 and Push are separate processes in this package. Layer 1 never holds APNs credentials or the device-token database. Push never sees Relay tunnel frames, pairing secrets, or client bearer credentials. Give Apple secrets only to the Push process. SQLite token storage is single-instance: one Push process per database file.
+
 ## Quick deployment
 
 Install the package, then start the Relay:
@@ -27,6 +29,18 @@ The default listener is `127.0.0.1:8787` and the WebSocket path is `/ws`. Deploy
 openchamber-relay --public-url wss://relay.example.com/ws
 ```
 
+Push is a second executable from the same package. Default listen address is `127.0.0.1:8788`:
+
+```sh
+export OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID='<apns-key-id>'
+export OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID='<apns-team-id>'
+export OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID=com.yee94.openchamber
+export OPENCHAMBER_PUSH_RELAY_APNS_P8_PATH=/etc/openchamber/AuthKey.p8
+openchamber-push-relay --host 127.0.0.1 --port 8788
+```
+
+The Host maps the effective Relay `wss://`/`ws://` URL to the same host as `https://`/`http://` `/v1/push/send`. Set `OPENCHAMBER_PUSH_RELAY_URL` on the Host to override. After a Relay switch, the Host re-registers persisted tokens and binds them before the first send.
+
 ### Caddy
 
 ```caddyfile
@@ -39,6 +53,24 @@ relay.example.com {
 
 Run the Relay with `--public-url wss://relay.example.com/ws`. Caddy proxies WebSocket upgrades for `/ws` and serves `/healthz` and `/readyz` through the same upstream. `header_up X-Forwarded-For {remote_host}` replaces the inbound value with the single client source IP.
 
+Shared hostname with Push:
+
+```caddyfile
+relay.example.com {
+    handle /v1/push/* {
+        reverse_proxy 127.0.0.1:8788 {
+            header_up X-Forwarded-For {remote_host}
+        }
+    }
+
+    handle {
+        reverse_proxy 127.0.0.1:8787 {
+            header_up X-Forwarded-For {remote_host}
+        }
+    }
+}
+```
+
 ### Nginx
 
 ```nginx
@@ -60,11 +92,11 @@ server {
 }
 ```
 
-Run the Relay with `--public-url wss://relay.example.com/ws`. The `/ws` path in the public URL and Relay configuration must match. `proxy_set_header X-Forwarded-For $remote_addr;` replaces the inbound value with the single client source IP.
+Run the Relay with `--public-url wss://relay.example.com/ws`. The `/ws` path in the public URL and Relay configuration must match. `proxy_set_header X-Forwarded-For $remote_addr;` replaces the inbound value with the single client source IP. For Push on the same hostname, proxy `/v1/push/` to `127.0.0.1:8788` and keep `/` including `/ws` on `127.0.0.1:8787`, replacing `X-Forwarded-For` on both locations.
 
 ## Docker
 
-Each non-dry-run OpenChamber release publishes a multi-platform Relay image for `linux/amd64` and `linux/arm64` to Docker Hub. CI builds each architecture natively in parallel (`ubuntu-latest` and `ubuntu-24.04-arm`), then merges digests into a single multi-arch manifest tagged as:
+Each non-dry-run OpenChamber `v*` release and each `relay/v*` Relay-only release publishes a multi-platform Relay image for `linux/amd64` and `linux/arm64` to Docker Hub. The image default entrypoint is Layer 1. The same image includes Node 24 plus `openchamber-push-relay` source/bin/package files. Layer 1 is compiled with Bun 1.3.14; Push is not Bun-compiled and runs under Node 24 (`node:sqlite`). The container user is non-root, ports `8787` and `8788` are exposed, and the image health check uses Node against Layer 1 `/healthz`. CI builds each architecture natively in parallel (`ubuntu-latest` and `ubuntu-24.04-arm`), then merges digests into a single multi-arch manifest tagged as:
 
 ```text
 <DOCKERHUB_USERNAME>/openchamber-relay:<version>
@@ -109,6 +141,27 @@ curl -fsS https://relay.example.com/healthz
 curl -fsS https://relay.example.com/readyz
 ```
 
+Layer 1 plus Push from the same immutable image uses [`docker-compose.relay-push.remote.yml`](../../docker-compose.relay-push.remote.yml). Layer 1 receives no APNs secrets. Push receives only APNs Key ID / Team ID / Bundle ID and the `.p8` Docker secret path, plus a persistent SQLite volume, with a read-only root filesystem. Caddy serves one hostname: `/v1/push/*` to `push:8788`, everything else including `/ws` to `relay:8787`, each replacing `X-Forwarded-For` once. Both services have health checks; Caddy waits until both are healthy.
+
+```sh
+OPENCHAMBER_RELAY_IMAGE='<dockerhub-username>/openchamber-relay:<version>@sha256:<manifest-digest>' \
+RELAY_DOMAIN=relay.example.com \
+ACME_EMAIL=admin@example.com \
+OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID='<apns-key-id>' \
+OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID='<apns-team-id>' \
+OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID=com.yee94.openchamber \
+OPENCHAMBER_PUSH_RELAY_APNS_P8_FILE=/etc/openchamber/AuthKey.p8 \
+docker compose -f docker-compose.relay-push.remote.yml up -d
+```
+
+```sh
+docker compose -f docker-compose.relay-push.remote.yml ps
+curl -fsS https://relay.example.com/healthz
+curl -fsS https://relay.example.com/readyz
+```
+
+Public `/healthz` and `/readyz` are Layer 1. Push health remains on the internal `8788` listener and the Compose health check. Existing Layer-1-only Compose files keep their previous behavior.
+
 From the repository root, build and start the supplied service. The compatibility assets are [`Dockerfile.relay`](../../Dockerfile.relay) and [`docker-compose.relay.yml`](../../docker-compose.relay.yml):
 
 ```sh
@@ -117,7 +170,7 @@ OPENCHAMBER_RELAY_PUBLISHED_PORT=8787 \
 docker compose -f docker-compose.relay.yml up -d --build
 ```
 
-Compose publishes `127.0.0.1:${OPENCHAMBER_RELAY_PUBLISHED_PORT:-8787}` by default; use `OPENCHAMBER_RELAY_PUBLISHED_PORT` to select the host port. The Compose service uses an ephemeral filesystem and keeps Host identity keys on each OpenChamber Host. Its image health check calls `GET /healthz`. Terminate public TLS at an external reverse proxy and publish `wss://relay.example.com/ws`. A public Relay port binding requires firewall rules and TLS; loopback publishing with a TLS reverse proxy is the deployment path.
+Compose publishes `127.0.0.1:${OPENCHAMBER_RELAY_PUBLISHED_PORT:-8787}` by default; use `OPENCHAMBER_RELAY_PUBLISHED_PORT` to select the host port. The Compose service uses an ephemeral filesystem and keeps Host identity keys on each OpenChamber Host. Its image health check uses Node to call Layer 1 `GET /healthz`. Terminate public TLS at an external reverse proxy and publish `wss://relay.example.com/ws`. A public Relay port binding requires firewall rules and TLS; loopback publishing with a TLS reverse proxy is the deployment path.
 
 ## Connect Hosts
 
@@ -134,7 +187,7 @@ Existing clients switch to a new Relay after a new pairing flow; generate a fres
 
 ## Configuration
 
-Configuration precedence is command flags, then `OPENCHAMBER_RELAY_SERVER_*` variables, then defaults. `--host`, `--port`, `--path`, `--public-url`, `--trust-proxy`, `--no-trust-proxy`, `--json`, and `--quiet` are available.
+Configuration precedence is command flags, then `OPENCHAMBER_RELAY_SERVER_*` variables, then defaults. `--host`, `--port`, `--path`, `--public-url`, `--trust-proxy`, `--no-trust-proxy`, `--json`, and `--quiet` are available. Push flags are `--host`, `--port`, `--trust-proxy`, `--no-trust-proxy`, `--json`, and `--quiet`, with `OPENCHAMBER_PUSH_RELAY_*` variables.
 
 `OPENCHAMBER_RELAY_SERVER_PUBLIC_URL` affects startup output. `OPENCHAMBER_RELAY_SERVER_PATH` selects the actual WebSocket upgrade endpoint. Relay listens on loopback by default. Enable `OPENCHAMBER_RELAY_SERVER_TRUST_PROXY=true` when a trusted reverse proxy fully isolates Relay ingress and replaces any client-supplied `X-Forwarded-For` value with one canonical client IP. Relay accepts one forwarded IP in this mode.
 
@@ -179,12 +232,44 @@ For an IPv6 literal in a public URL, enclose the host in brackets: `wss://[2001:
 | `OPENCHAMBER_RELAY_SERVER_MAX_ADMISSION_ENTRIES` | `10000` | tracked role/IP admission records |
 | `OPENCHAMBER_RELAY_SERVER_ID_ATTEMPTS` | `4` | random connection-ID attempts |
 
+Host Push URL (OpenChamber Host, not the Push process):
+
+| Variable | Default | Unit / purpose |
+| --- | --- | --- |
+| `OPENCHAMBER_PUSH_RELAY_URL` | derived from the effective Relay URL | explicit `…/v1/push/send` override |
+| `OPENCHAMBER_PUSH_RELAY_DISABLED` | unset | `true` disables Push Relay on the Host |
+
+Push process:
+
+| Variable | Default | Unit / purpose |
+| --- | --- | --- |
+| `OPENCHAMBER_PUSH_RELAY_HOST` | `127.0.0.1` | Listener address |
+| `OPENCHAMBER_PUSH_RELAY_PORT` | `8788` | TCP port |
+| `OPENCHAMBER_PUSH_RELAY_TRUST_PROXY` | `false` | Read one canonical client IP from proxy-replaced `X-Forwarded-For` |
+| `OPENCHAMBER_PUSH_RELAY_DATABASE_PATH` | `./data/push-relay.sqlite` | SQLite file |
+| `OPENCHAMBER_PUSH_RELAY_TIMESTAMP_SKEW_MS` | `300000` | ms signed `ts` window |
+| `OPENCHAMBER_PUSH_RELAY_REPLAY_MS` | `600000` | ms replay-record lifetime; at least twice timestamp skew |
+| `OPENCHAMBER_PUSH_RELAY_MAX_REPLAY_ENTRIES` | `10000` | replay records |
+| `OPENCHAMBER_PUSH_RELAY_REGISTER_LIMIT_PER_MINUTE` | `60` | register requests per client IP per minute |
+| `OPENCHAMBER_PUSH_RELAY_SEND_LIMIT_PER_MINUTE` | `60` | send requests per client IP per minute |
+| `OPENCHAMBER_PUSH_RELAY_SERVER_SEND_LIMIT_PER_MINUTE` | `120` | send requests per `serverId` per minute |
+| `OPENCHAMBER_PUSH_RELAY_MAX_TOKENS` | `100000` | persisted device-token bindings |
+| `OPENCHAMBER_PUSH_RELAY_MAX_IN_FLIGHT` | `64` | concurrent APNs deliveries |
+| `OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID` | required | Apple APNs key ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID` | required | Apple Team ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID` | `com.yee94.openchamber` | App bundle ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_P8` | required unless path set | APNs `.p8` PEM |
+| `OPENCHAMBER_PUSH_RELAY_APNS_P8_PATH` | unset | Path to the `.p8` file |
+
+TestFlight and App Store Hosts use `OPENCHAMBER_APNS_ENVIRONMENT=production`. Each send request carries `env`; the Push process does not pick sandbox vs production itself.
+
 ## Operations
 
 - `GET` and `HEAD` requests to `/healthz` return process health. `/readyz` returns ready status after the listener reaches running state.
 - `SIGTERM` and `SIGINT` begin graceful Relay shutdown. Docker grants a 30-second stop period.
 - Hosts automatically reconnect after a Relay process restart. Relay state remains ephemeral.
-- Keep logs and metrics snapshots free of URL query strings, `sig`, `pk`, `grant`, and encrypted payloads.
+- Keep logs and metrics snapshots free of URL query strings, `sig`, `pk`, `grant`, encrypted payloads, APNs `.p8` material, and device tokens.
+- Run one Push process per SQLite database file.
 
 ### systemd
 

package/README.md

@@ -2,6 +2,8 @@
 
 `openchamber-relay` is the self-hosted Layer 1 relay for OpenChamber remote access. It gives OpenChamber Hosts an outbound Relay connection and carries encrypted client traffic through that connection.
 
+The same `@openchambery/relay-server` package also ships `openchamber-push-relay`, an isolated APNs push process. Layer 1 never receives Apple credentials. Push never terminates E2EE tunnels.
+
 The Relay routes opaque Layer 2/3 frames verbatim. E2EE terminates at the OpenChamber Host and Client, so the Relay has routing metadata and transport state while the endpoints hold application plaintext, pairing secrets, and client bearer credentials. Host Relay connections authenticate with the Host's long-lived P-256 signing key. Relay reachability grants transport access; endpoint validation continues to enforce pairing and client credentials.
 
 ## Architecture and transport
@@ -19,10 +21,19 @@ Relay state lives in process memory. Hosts reconnect after a Relay restart. A di
 
 Relay v1 accepts anonymous Client route requests. Admission, connection, frame, queue, and socket limits bound this public entry point.
 
+## Dual-process security boundary
+
+Layer 1 (`openchamber-relay`) and Push (`openchamber-push-relay`) are separate processes in one package:
+
+- Layer 1 authenticates Hosts, brokers WebSocket routes, and forwards opaque frames. It has no APNs key, no device-token database, and no `/v1/push/*` handlers.
+- Push verifies Host signatures, binds `token → serverId` in a local SQLite database, and holds the project APNs `.p8` key. It has no access to Relay tunnels, pairing secrets, or client bearer credentials.
+- Deploy them as two containers from the same immutable image. Give APNs Key ID / Team ID / Bundle ID and the `.p8` secret only to the Push container. Keep Layer 1 free of those secrets.
+- SQLite is a single-writer store. Run one Push instance per database file. Do not share that volume across replicas.
+
 ## Requirements
 
-- `@openchambery/relay-server` installation: Node.js 22 or later and a supported package manager such as npm, pnpm, yarn, or Bun.
-- Single-file bundle build: Bun. This repository uses Bun 1.3.14.
+- `@openchambery/relay-server` installation: Node.js 22.13 or later and a supported package manager such as npm, pnpm, yarn, or Bun. Push uses Node's built-in `node:sqlite`.
+- Single-file Layer 1 bundle build: Bun. This repository uses Bun 1.3.14. Do not Bun-compile the Push entry; Docker runs it with Node 24.
 - Public deployment: a DNS name, TLS certificate, reverse proxy, and firewall policy appropriate for the deployment.
 
 ## Install and quick start
@@ -36,6 +47,20 @@ openchamber-relay --public-url wss://relay.example.com/ws
 
 The default listener is `127.0.0.1:8787` and the default WebSocket upgrade path is `/ws`. Keep this loopback listener behind a TLS reverse proxy and set `--public-url` to the public `ws://` or `wss://` URL with the same path.
 
+Start the isolated Push process from the same package. The default listener is `127.0.0.1:8788`. APNs Key ID, Team ID, and a `.p8` value or file path are required:
+
+```sh
+export OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID='<apns-key-id>'
+export OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID='<apns-team-id>'
+export OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID=com.yee94.openchamber
+export OPENCHAMBER_PUSH_RELAY_APNS_P8_PATH=/etc/openchamber/AuthKey.p8
+openchamber-push-relay --host 127.0.0.1 --port 8788
+```
+
+Keep Push on loopback behind the same TLS reverse proxy. Route only `/v1/push/*` to port 8788.
+
+OpenChamber Hosts do not need a separate Push URL when they already have a Relay URL. The effective `wss://` or `ws://` Relay URL maps to the same host as `https://` or `http://` `/v1/push/send` (register is `/v1/push/register-token`). Set `OPENCHAMBER_PUSH_RELAY_URL` on the Host to override that mapping. After a Relay switch, the Host re-registers persisted device tokens and binds them again before the first send.
+
 ### Build a standalone executable
 
 Run these commands from the repository root. `bun build --compile` creates a single executable for the current platform and architecture.
@@ -91,6 +116,18 @@ Available CLI options:
 --version, -v
 ```
 
+Push CLI options:
+
+```text
+--host HOST
+--port PORT
+--trust-proxy | --no-trust-proxy
+--json
+--quiet, -q
+--help, -h
+--version, -v
+```
+
 ## Connect OpenChamber Hosts
 
 Set the public Relay URL in every OpenChamber Host environment, then start the Host and create a Relay pairing link or enable Relay pairing in the application.
@@ -120,6 +157,24 @@ relay.example.com {
 
 Run the Relay with `--public-url wss://relay.example.com/ws`. Caddy forwards WebSocket upgrades and serves `/healthz` and `/readyz` from the same upstream. The `X-Forwarded-For` rule writes one canonical Client source IP.
 
+When Push shares the hostname, send `/v1/push/*` to the Push listener and replace `X-Forwarded-For` once on each upstream:
+
+```caddyfile
+relay.example.com {
+    handle /v1/push/* {
+        reverse_proxy 127.0.0.1:8788 {
+            header_up X-Forwarded-For {remote_host}
+        }
+    }
+
+    handle {
+        reverse_proxy 127.0.0.1:8787 {
+            header_up X-Forwarded-For {remote_host}
+        }
+    }
+}
+```
+
 ### Nginx
 
 ```nginx
@@ -143,6 +198,8 @@ server {
 
 Run the Relay with `--public-url wss://relay.example.com/ws`. Nginx writes one canonical Client source IP with `$remote_addr` and forwards WebSocket upgrades over HTTP/1.1.
 
+To share the hostname with Push, proxy `/v1/push/` to `127.0.0.1:8788` and keep `/` (including `/ws`) on `127.0.0.1:8787`. Replace `X-Forwarded-For` with `$remote_addr` on both locations.
+
 ## Trusted proxies and capacity
 
 Enable `OPENCHAMBER_RELAY_SERVER_TRUST_PROXY=true` or `--trust-proxy` when a trusted reverse proxy fully isolates Relay ingress and replaces each inbound `X-Forwarded-For` value with one canonical Client IP.
@@ -195,6 +252,43 @@ Trusted-proxy mode accepts exactly one valid IP address in `X-Forwarded-For`. Cl
 | `OPENCHAMBER_RELAY_SERVER_MAX_ADMISSION_ENTRIES` | `10000` | tracked role/IP admission records |
 | `OPENCHAMBER_RELAY_SERVER_ID_ATTEMPTS` | `4` | random connection-ID attempts |
 
+### Host Push URL override
+
+These variables belong on the OpenChamber Host, not on the Push process:
+
+| Variable | Default | Unit / purpose |
+| --- | --- | --- |
+| `OPENCHAMBER_PUSH_RELAY_URL` | derived from the effective Relay `ws`/`wss` URL | Host override for `https://` or `http://` `…/v1/push/send` |
+| `OPENCHAMBER_PUSH_RELAY_DISABLED` | unset | Host-only; `true` skips Push Relay and uses direct APNs |
+
+The derived send URL always uses `/v1/push/send` on the same host and port as the Relay URL. `wss` maps to `https`; `ws` maps to `http`. Register is the same origin with `/v1/push/register-token`.
+
+### Push process environment
+
+Command flags take precedence over `OPENCHAMBER_PUSH_RELAY_*` variables, which take precedence over defaults. APNs Key ID, Team ID, and `.p8` material are required.
+
+| Variable | Default | Unit / purpose |
+| --- | --- | --- |
+| `OPENCHAMBER_PUSH_RELAY_HOST` | `127.0.0.1` | Listener address |
+| `OPENCHAMBER_PUSH_RELAY_PORT` | `8788` | TCP port |
+| `OPENCHAMBER_PUSH_RELAY_TRUST_PROXY` | `false` | Read one canonical Client IP from proxy-replaced `X-Forwarded-For` |
+| `OPENCHAMBER_PUSH_RELAY_DATABASE_PATH` | `./data/push-relay.sqlite` | SQLite file; directory must be writable |
+| `OPENCHAMBER_PUSH_RELAY_TIMESTAMP_SKEW_MS` | `300000` | ms signed `ts` window |
+| `OPENCHAMBER_PUSH_RELAY_REPLAY_MS` | `600000` | ms replay-record lifetime; at least twice timestamp skew |
+| `OPENCHAMBER_PUSH_RELAY_MAX_REPLAY_ENTRIES` | `10000` | replay records |
+| `OPENCHAMBER_PUSH_RELAY_REGISTER_LIMIT_PER_MINUTE` | `60` | register requests per Client IP per minute |
+| `OPENCHAMBER_PUSH_RELAY_SEND_LIMIT_PER_MINUTE` | `60` | send requests per Client IP per minute |
+| `OPENCHAMBER_PUSH_RELAY_SERVER_SEND_LIMIT_PER_MINUTE` | `120` | send requests per `serverId` per minute |
+| `OPENCHAMBER_PUSH_RELAY_MAX_TOKENS` | `100000` | persisted device-token bindings |
+| `OPENCHAMBER_PUSH_RELAY_MAX_IN_FLIGHT` | `64` | concurrent APNs deliveries |
+| `OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID` | required | Apple APNs key ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID` | required | Apple Team ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID` | `com.yee94.openchamber` | App bundle ID |
+| `OPENCHAMBER_PUSH_RELAY_APNS_P8` | required unless path set | APNs `.p8` PEM; literal `\n` accepted |
+| `OPENCHAMBER_PUSH_RELAY_APNS_P8_PATH` | unset | Path to the `.p8` file; used when `APNS_P8` is empty |
+
+TestFlight and App Store Hosts send `env: production` (`OPENCHAMBER_APNS_ENVIRONMENT=production` on the Host). Xcode development builds use `sandbox`. The Push process does not choose the APNs environment; each send request carries it.
+
 ## systemd
 
 Create `/etc/openchamber-relay.env`:
@@ -236,11 +330,12 @@ sudo systemctl status openchamber-relay
 - `SIGTERM` and `SIGINT` start graceful Relay shutdown. Hosts reconnect after a process restart.
 - Size Host, Client, pending, socket, frame, and queue limits for expected concurrency and message volume.
 - Keep the default loopback listener, terminate public TLS at a reverse proxy, restrict ingress with firewall rules, and publish the matching `wss://` URL.
-- Keep logs and metrics snapshots free of URL query strings, `sig`, `pk`, `grant`, encrypted payloads, pairing material, and bearer credentials.
+- Keep logs and metrics snapshots free of URL query strings, `sig`, `pk`, `grant`, encrypted payloads, pairing material, bearer credentials, APNs `.p8` contents, Key ID / Team ID values, and device tokens.
+- Run a single Push process per SQLite file. WAL mode does not make multi-instance sharing safe.
 
 ## Docker delivery assets
 
-Each non-dry-run OpenChamber release publishes a Docker Hub image for `linux/amd64` and `linux/arm64` as `<DOCKERHUB_USERNAME>/openchamber-relay:<version>` and `<DOCKERHUB_USERNAME>/openchamber-relay:latest`. The release pipeline requires the `DOCKERHUB_USERNAME` GitHub Actions repository variable and a `DOCKERHUB_TOKEN` repository secret with Docker Hub Read and Write permissions. Image publication must succeed before the GitHub Release is finalized.
+Each non-dry-run OpenChamber `v*` release and each `relay/v*` Relay-only release publishes a Docker Hub image for `linux/amd64` and `linux/arm64` as `<DOCKERHUB_USERNAME>/openchamber-relay:<version>` and `<DOCKERHUB_USERNAME>/openchamber-relay:latest`. The image default entrypoint is Layer 1. The same image also contains Node 24 and the `openchamber-push-relay` source/bin/package files. Layer 1 is a Bun 1.3.14 compile standalone; Push is executed with Node 24 and `node:sqlite`. The container runs as a non-root user, exposes `8787` and `8788`, and health-checks Layer 1 with Node. The release pipeline requires the `DOCKERHUB_USERNAME` GitHub Actions repository variable and a `DOCKERHUB_TOKEN` repository secret with Docker Hub Read and Write permissions. Image publication must succeed before the GitHub Release is finalized. `relay/v*` publishes the same npm package and Docker image without desktop, mobile, TestFlight, or OTA artifacts.
 
 The `Relay Docker` workflow can republish only the current Relay package version without creating or modifying a GitHub Release or other platform artifacts.
 
@@ -270,6 +365,23 @@ docker compose -f docker-compose.relay.remote.yml up -d
 
 `OPENCHAMBER_RELAY_IMAGE` is required so the repository never binds this reusable deployment file to a personal registry namespace. Use an immutable version-and-digest reference in production.
 
+To run Layer 1 and Push from that same immutable image, with APNs secrets only on Push, a persistent SQLite volume, read-only root filesystems, and Caddy routing `/v1/push/*` to Push, use [`docker-compose.relay-push.remote.yml`](../../docker-compose.relay-push.remote.yml):
+
+```sh
+OPENCHAMBER_RELAY_IMAGE='<dockerhub-username>/openchamber-relay:<version>@sha256:<manifest-digest>' \
+RELAY_DOMAIN=relay.example.com \
+ACME_EMAIL=admin@example.com \
+OPENCHAMBER_PUSH_RELAY_APNS_KEY_ID='<apns-key-id>' \
+OPENCHAMBER_PUSH_RELAY_APNS_TEAM_ID='<apns-team-id>' \
+OPENCHAMBER_PUSH_RELAY_APNS_BUNDLE_ID=com.yee94.openchamber \
+OPENCHAMBER_PUSH_RELAY_APNS_P8_FILE=/etc/openchamber/AuthKey.p8 \
+docker compose -f docker-compose.relay-push.remote.yml up -d
+```
+
+The Push container reads the `.p8` from the Docker secret path `/run/secrets/apns_p8`. Layer 1 does not receive that secret. Inspect both health checks with `docker compose -f docker-compose.relay-push.remote.yml ps`. Public `/healthz` and `/readyz` are Layer 1. Push `/healthz` stays on the internal listener.
+
+Existing Layer-1-only Compose files keep their current behavior: [`docker-compose.relay.yml`](../../docker-compose.relay.yml) for loopback, and [`docker-compose.relay.remote.yml`](../../docker-compose.relay.remote.yml) for public Layer 1 without Push.
+
 The repository provides optional Docker delivery assets at [`Dockerfile.relay`](../../Dockerfile.relay) and [`docker-compose.relay.yml`](../../docker-compose.relay.yml). The Compose service publishes `127.0.0.1:${OPENCHAMBER_RELAY_PUBLISHED_PORT:-8787}` and accepts `OPENCHAMBER_RELAY_SERVER_PUBLIC_URL` plus selected Relay limits.
 
 ```sh
@@ -291,6 +403,9 @@ These assets define an optional follow-on deployment path. Validate the image, p
 | Per-Client IP limits behave as proxy limits | Enable trusted-proxy mode, fully isolate Relay ingress behind that proxy, and configure a single replaced `X-Forwarded-For` IP. |
 | Existing clients continue using an earlier endpoint | Refresh the candidate or create a new pairing link after changing `OPENCHAMBER_RELAY_URL`. |
 | WebSocket application traffic fails while HTTP works | Confirm the Host endpoint mints and supplies a short-lived `oc_url_token` for the WebSocket path. |
+| Push register or send returns 404 on the public hostname | Confirm the reverse proxy sends `/v1/push/*` to the Push listener on port 8788, not to Layer 1. |
+| Push container is unhealthy | Confirm APNs Key ID / Team ID / Bundle ID and the `.p8` secret path, and that the SQLite volume is writable by the non-root user. |
+| Device tokens stop receiving after a Relay URL change | Confirm the Host re-registered against the new Push origin before the first send, or set `OPENCHAMBER_PUSH_RELAY_URL` explicitly. |
 
 ## Development and test coverage
 

package/bin/openchamber-push-relay.js

@@ -0,0 +1,11 @@
+#!/usr/bin/env node
+import packageJson from '../package.json' with { type: 'json' };
+
+import { isModuleCliExecution } from './cli-entry.js';
+import { runPushRelayCli } from '../src/push/cli.js';
+
+const version = packageJson.version;
+
+if (isModuleCliExecution(process.argv[1], import.meta.url, undefined, 'openchamber-push-relay')) {
+  runPushRelayCli(process.argv.slice(2), { version }).then((code) => { process.exitCode = code; });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openchambery/relay-server",
-  "version": "1.19.0-beta.4",
+  "version": "1.19.0-beta.41",
   "description": "Self-hosted private relay server for OpenChamber",
   "private": false,
   "type": "module",
@@ -11,16 +11,22 @@
       "types": "./src/index.d.ts",
       "import": "./src/index.js",
       "default": "./src/index.js"
+    },
+    "./push": {
+      "types": "./src/push/index.d.ts",
+      "import": "./src/push/index.js",
+      "default": "./src/push/index.js"
     }
   },
   "bin": {
-    "openchamber-relay": "./bin/openchamber-relay.js"
+    "openchamber-relay": "./bin/openchamber-relay.js",
+    "openchamber-push-relay": "./bin/openchamber-push-relay.js"
   },
   "publishConfig": {
     "access": "public"
   },
   "engines": {
-    "node": ">=22.0.0"
+    "node": ">=22.13.0"
   },
   "license": "MIT",
   "repository": {
@@ -40,8 +46,8 @@
   "scripts": {
     "test": "vitest run",
     "test:node": "node test/node-smoke.js",
-    "type-check": "node --check src/index.js && node --check src/cli.js && node --check bin/openchamber-relay.js && node --check bin/cli-entry.js",
-    "lint": "node --check src/index.js && node --check src/cli.js && node --check bin/openchamber-relay.js && node --check bin/cli-entry.js",
+    "type-check": "node --check src/index.js && node --check src/cli.js && node --check bin/openchamber-relay.js && node --check bin/cli-entry.js && node --check src/push/index.js && node --check src/push/server.js && node --check src/push/cli.js && node --check src/push/config.js && node --check src/push/schema.js && node --check src/push/crypto.js && node --check src/push/store.js && node --check src/push/guard.js && node --check src/push/apns.js && node --check bin/openchamber-push-relay.js",
+    "lint": "node --check src/index.js && node --check src/cli.js && node --check bin/openchamber-relay.js && node --check bin/cli-entry.js && node --check src/push/index.js && node --check src/push/server.js && node --check src/push/cli.js && node --check src/push/config.js && node --check src/push/schema.js && node --check src/push/crypto.js && node --check src/push/store.js && node --check src/push/guard.js && node --check src/push/apns.js && node --check bin/openchamber-push-relay.js",
     "build:standalone": "bun build --compile --outfile dist/openchamber-relay bin/openchamber-relay.js"
   },
   "dependencies": {

package/src/push/apns.js

@@ -0,0 +1,137 @@
+import crypto from 'node:crypto';
+import http2 from 'node:http2';
+
+const APNS_HOST = {
+  production: 'https://api.push.apple.com',
+  sandbox: 'https://api.sandbox.push.apple.com',
+};
+const JWT_TTL_MS = 50 * 60 * 1000;
+const SESSION_TTL_MS = 30 * 60 * 1000;
+const REQUEST_TIMEOUT_MS = 5_000;
+const MAX_RESPONSE_BYTES = 4_096;
+export const DEAD_TOKEN_REASONS = new Set(['BadDeviceToken', 'Unregistered', 'DeviceTokenNotForTopic']);
+
+const normalizePem = (value) => (typeof value === 'string' ? value.replace(/\\n/g, '\n').trim() : '');
+
+export const createApnsProvider = (options = {}) => {
+  const clock = { now: Date.now, setTimeout, clearTimeout, ...options.clock };
+  const connect = options.http2?.connect ?? http2.connect;
+  const sessionTtlMs = options.sessionTtlMs ?? SESSION_TTL_MS;
+  let privateKey;
+  try {
+    privateKey = crypto.createPrivateKey(normalizePem(options.p8));
+  } catch {
+    throw new Error('Invalid APNs key');
+  }
+  const bundleId = options.bundleId;
+  const sessions = new Map();
+  let cachedJwt = null;
+
+  const signJwt = () => {
+    const header = Buffer.from(JSON.stringify({ alg: 'ES256', kid: options.keyId })).toString('base64url');
+    const claims = Buffer.from(JSON.stringify({ iss: options.teamId, iat: Math.floor(clock.now() / 1000) })).toString('base64url');
+    const signingInput = `${header}.${claims}`;
+    const signature = crypto.sign('sha256', Buffer.from(signingInput), { key: privateKey, dsaEncoding: 'ieee-p1363' }).toString('base64url');
+    return `${signingInput}.${signature}`;
+  };
+
+  const getJwt = (force) => {
+    const now = clock.now();
+    if (!force && cachedJwt && now - cachedJwt.issuedAtMs < JWT_TTL_MS) return cachedJwt.token;
+    cachedJwt = { token: signJwt(), issuedAtMs: now };
+    return cachedJwt.token;
+  };
+
+  const dropSession = (env, client) => {
+    const current = sessions.get(env);
+    if (current?.client === client) sessions.delete(env);
+    try { client.close(); } catch { /* session already gone */ }
+  };
+
+  const getSession = (env) => {
+    const existing = sessions.get(env);
+    if (existing?.client && !existing.client.closed && existing.client.destroyed !== true) {
+      if (clock.now() - existing.createdAt < sessionTtlMs) return existing.client;
+      dropSession(env, existing.client);
+    }
+    const client = connect(APNS_HOST[env]);
+    client.on('error', () => dropSession(env, client));
+    client.on('close', () => { if (sessions.get(env)?.client === client) sessions.delete(env); });
+    sessions.set(env, { client, createdAt: clock.now() });
+    return client;
+  };
+
+  const dispatch = (input, forceJwt) => new Promise((resolve) => {
+    const jwt = getJwt(forceJwt);
+    let client;
+    try { client = getSession(input.env); } catch { resolve({ ok: false }); return; }
+    const headers = {
+      ':method': 'POST',
+      ':path': `/3/device/${input.token}`,
+      authorization: `bearer ${jwt}`,
+      'apns-topic': bundleId,
+      'apns-push-type': 'alert',
+      'apns-priority': '10',
+    };
+    if (input.collapseId) headers['apns-collapse-id'] = input.collapseId;
+    let req;
+    try { req = client.request(headers); } catch {
+      dropSession(input.env, client);
+      resolve({ ok: false });
+      return;
+    }
+    let status = 0;
+    const chunks = [];
+    let responseBytes = 0;
+    let settled = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clock.clearTimeout(timer);
+      resolve(result);
+    };
+    const timer = clock.setTimeout(() => {
+      try { req.close(); } catch { /* ignore */ }
+      finish({ ok: false });
+    }, options.requestTimeoutMs ?? REQUEST_TIMEOUT_MS);
+    req.on('response', (responseHeaders) => { status = Number(responseHeaders[':status']) || 0; });
+    req.on('data', (chunk) => {
+      if (responseBytes >= MAX_RESPONSE_BYTES) return;
+      const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+      const take = buf.length > MAX_RESPONSE_BYTES - responseBytes ? buf.subarray(0, MAX_RESPONSE_BYTES - responseBytes) : buf;
+      chunks.push(take);
+      responseBytes += take.length;
+    });
+    req.on('end', () => {
+      if (status === 200) { finish({ ok: true }); return; }
+      let reason = '';
+      try { reason = JSON.parse(Buffer.concat(chunks, responseBytes).toString('utf8'))?.reason || ''; } catch { /* non-JSON */ }
+      if (reason === 'ExpiredProviderToken') { finish({ ok: false, expired: true }); return; }
+      if (status === 410 || DEAD_TOKEN_REASONS.has(reason)) { finish({ ok: false, drop: true }); return; }
+      finish({ ok: false });
+    });
+    req.on('error', () => {
+      if (!settled) dropSession(input.env, client);
+      finish({ ok: false });
+    });
+    req.end(JSON.stringify(input.payload));
+  });
+
+  return {
+    async send(input) {
+      const first = await dispatch(input, false);
+      if (first.expired) {
+        const retry = await dispatch(input, true);
+        return { ok: retry.ok === true, drop: retry.drop === true ? true : undefined };
+      }
+      return { ok: first.ok === true, drop: first.drop === true ? true : undefined };
+    },
+    close() {
+      for (const [env, entry] of sessions) {
+        sessions.delete(env);
+        try { entry.client.close(); } catch { /* ignore */ }
+      }
+      cachedJwt = null;
+    },
+  };
+};

package/src/push/cli.js

@@ -0,0 +1,73 @@
+import { startPushRelayServer } from './server.js';
+import { buildPushRelayConfig, fail, formatPushRelayUrl } from './config.js';
+
+export { buildPushRelayConfig } from './config.js';
+
+export const parsePushRelayArgs = (argv = []) => {
+  const parsed = {};
+  const values = new Map([['--host', 'host'], ['--port', 'port']]);
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (values.has(arg)) {
+      const value = argv[++index];
+      if (!value || value.startsWith('--')) fail(arg);
+      parsed[values.get(arg)] = value;
+      continue;
+    }
+    if (arg === '--trust-proxy') { parsed.trustProxy = true; continue; }
+    if (arg === '--no-trust-proxy') { parsed.trustProxy = false; continue; }
+    if (arg === '--json') { parsed.json = true; continue; }
+    if (arg === '--quiet' || arg === '-q') { parsed.quiet = true; continue; }
+    if (arg === '--help' || arg === '-h') { parsed.help = true; continue; }
+    if (arg === '--version' || arg === '-v') { parsed.version = true; continue; }
+    fail(arg);
+  }
+  return parsed;
+};
+
+const helpText = 'Usage: openchamber-push-relay [--host HOST] [--port PORT] [--trust-proxy] [--json] [--quiet]\nEnable --trust-proxy only when public ingress reaches this relay through a trusted reverse proxy.\n';
+const writeJson = (stdout, payload) => stdout.write(`${JSON.stringify(payload)}\n`);
+
+export const runPushRelayCli = async (argv, dependencies = {}) => {
+  const processLike = dependencies.process ?? process;
+  const stdout = dependencies.stdout ?? process.stdout;
+  const stderr = dependencies.stderr ?? process.stderr;
+  const version = dependencies.version ?? '0.0.0';
+  let parsed;
+  try { parsed = parsePushRelayArgs(argv ?? processLike.argv?.slice(2) ?? []); } catch (error) {
+    const json = (argv ?? processLike.argv?.slice(2) ?? []).includes('--json');
+    if (json) writeJson(stdout, { status: 'error', error: error.message }); else stderr.write(`${error.message}\n`);
+    processLike.exitCode = 1; return 1;
+  }
+  const json = parsed.json;
+  const respond = (payload, error = false, essential = false) => {
+    if (json) writeJson(stdout, payload);
+    else if (payload.message && (essential || !parsed.quiet || error)) (error ? stderr : stdout).write(`${payload.message}\n`);
+  };
+  if (parsed.help) { respond(json ? { status: 'ok', help: helpText.trim() } : { message: helpText.trim() }, false, true); return 0; }
+  if (parsed.version) { respond(json ? { status: 'ok', version } : { message: version }, false, true); return 0; }
+  let config;
+  try { config = buildPushRelayConfig(parsed, processLike.env ?? {}); } catch (error) { respond({ status: 'error', error: error.message, message: error.message }, true); processLike.exitCode = 1; return 1; }
+  try {
+    const relay = await (dependencies.start ?? startPushRelayServer)(config);
+    const port = relay.address?.()?.port ?? config.port;
+    const url = formatPushRelayUrl(config.host, port);
+    respond(json ? { status: 'ok', url, host: config.host, port } : { message: `Push relay listening at ${url}` });
+    let stopping = false;
+    const stop = async () => {
+      if (stopping) return Promise.resolve();
+      stopping = true;
+      processLike.off?.('SIGINT', stop); processLike.off?.('SIGTERM', stop);
+      try {
+        await relay.stop();
+        processLike.exit?.(0);
+      } catch {
+        processLike.exitCode = 1;
+        if (json) writeJson(stderr, { status: 'error', error: 'Push relay stop failed' }); else stderr.write('Push relay stop failed\n');
+        processLike.exit?.(1);
+      }
+    };
+    processLike.on?.('SIGINT', stop); processLike.on?.('SIGTERM', stop);
+    return 0;
+  } catch (error) { respond({ status: 'error', error: error.message, message: error.message }, true); processLike.exitCode = 1; return 1; }
+};