Optional · direct APNs relay

Run Drel
on your side.

Drel can pair with an authorized relay and send to APNs. This page makes the trust boundary explicit: the stock Drel App cannot safely hand its APNs signing key to every deployment.

Start the guide Read the boundaries

What a new user needs

Three basics.
One hard boundary.

A small Linux server

It needs outbound HTTPS. A Cloudflare Tunnel is supported, so you do not need to expose port 443.

Your HTTPS hostname

For example push.example.com. The Drel app validates this address before it pairs.

Drel on an iPhone

Install Drel, then connect once through Settings → Self-hosted Push. Every iPhone receives a different address.

Delivery authority

Direct APNs needs a private signer authorized for the App's topic. A stock Drel installation cannot create that key on a user's Apple team.

Current release state: the relay protocol is being verified, but Drel will not publish its APNs private key. push.drel.app intentionally reports that APNs is not ready and refuses pairing. It never pretends to deliver a push it cannot send.

1 / deploy

Keep the service
behind your hostname.

The binary binds only to localhost. A Cloudflare Tunnel provides the public HTTPS address without opening an inbound firewall port. It still needs legitimate APNs signing authority before it can pair a phone.

# advanced deployment: install an authorized relay
sudo install -m 0755 drel-selfhosted /usr/local/bin/
sudo install -m 0644 drel-selfhosted.service /etc/systemd/system/

# add your public hostname, then start
sudo systemctl enable --now drel-selfhosted
curl https://push.example.com/health

# expected only when delivery credentials are ready
{ "status": "ok", "apnsReady": true }

2 / pair once

Connect the
iPhone.

Open Drel → Settings → Self-hosted Push.

Scan the deployment QR code, or paste https://push.example.com.

Drel checks the server health, creates an installation-only key, and registers its APNs token with your server.

Copy the generated push URL to the sender you trust. It is a capability: anyone holding it can alert this phone.

3 / send

Choose the privacy
mode you need.

ADVANCED · OWN SIGNED APP

Direct push

A server with a valid private signer for its own Drel bundle receives the title, body, and optional URL, then sends it straight to APNs. This is the familiar Bark-style workflow.

# use the address shown by Drel
curl -G "https://push.example.com/DEVICE_KEY/Build%20ready/Inspect%20the%20result" \
  --data-urlencode "url=https://drel.app/"

Use it only when you own the corresponding Apple App ID, signing team, and Drel build. The server operator can read this request, so it is not zero-knowledge.

PLANNED · STOCK DREL APP

Encrypted push

The sender fetches the iPhone's public key, encrypts before upload, and posts an opaque envelope. A Drel-managed APNs signer can deliver it without reading business content, but it still receives delivery metadata.

# reference sender bundled with Drel
node drel-encrypt-and-push.mjs \
  https://push.example.com DEVICE_KEY \
  "Build ready" "Code 482901" \
  https://drel.app/

This is the feasible privacy path for the stock App; it is not shipped yet. It avoids publishing a reusable APNs private key; read the trust boundaries below before planning a deployment.

4 / rotate or leave

A leaked address
is recoverable.

Reset address

In Drel, choose Reset push address. Drel removes the old registration, discards its local encryption identity, pairs again, and shows a new device address. Update trusted senders.

Remove server

Choose Remove self-hosted server to delete the local configuration and private encryption material. Drel asks the server to unregister the exact token/address pair first.

Rotate APNs material

Never distribute a Drel APNs private key. An advanced developer rotates their own topic-specific key; the stock Drel App uses a managed signer instead.

Trust boundaries

What each key can — and cannot — do.

Material	What it allows	What it does not allow	Recovery
Device push address	Send an alert to that paired Drel installation.	Read message history, fetch an APNs token, or access the phone.	Reset the address in Drel.
Topic-specific APNs signer	Authenticate notification delivery for one bundle/topic.	Read notifications, access Apple accounts, or address arbitrary apps.	Keep private; its owning App team revokes and rotates it.
iPhone private key	Decrypt optional encrypted envelopes on that installation.	Send APNs notifications or be exported by the server.	Remove or reset the server connection.

An APNs signer is still a private signing key. Topic restriction limits its blast radius, but a holder can forge alerts to known device tokens. Drel does not publish it. The stock App's privacy route must use sender-side encryption plus a managed signer; a truly independent direct relay requires the operator's own signed Drel bundle and App topic.