Production checklist

Network exposure

Allow inbound UDP on the configured relay port. The default is 7770.
Allow inbound TCP on the HTTP port only if the administration API is enabled. The default is 7771.
Restrict the HTTP listener at the network or reverse-proxy layer. It binds to all interfaces.
Do not expose the admin token to game clients.

Secrets

Generate independent, high-entropy values for BLITZ_RELAY_CONNECTION_KEY and BLITZ_RELAY_HTTP_ADMIN_TOKEN.
Assume the connection key is distributed with the game client and is therefore not an operator-grade secret.
Keep room host tokens in host-only runtime state.
Rotate the server-wide admin token if it reaches an untrusted system.

Room durability

Rooms and metadata are in-memory state. A relay restart removes every ephemeral and persistent room. Design matchmaking to recreate persistent rooms after a restart and treat stale room codes as invalid.

Browser administration

The default CORS policy allows any origin, method, and header. Supply --cors with explicit origins for browser-based operator tools. CORS controls browsers; it does not replace bearer authentication or network access controls.

Traffic behaviour

Keep unreliable messages within the networking transport’s reported MTU.
Expect oversized unreliable messages to be dropped rather than fragmented.
Expect unreliable traffic to be dropped for a recipient whose reliable queue is backed up.
Treat a relay disconnect as a real peer failure; the server disconnects recipients whose reliable backlog reaches its protection threshold.

Process supervision

Run the relay under a supervisor such as systemd, Docker, or Kubernetes. The Generic Host handles Ctrl+C and termination signals and shuts down the UDP server and optional HTTP API together.