Stand up the hall

What a shed needs

The shed is the smallest hall: one host, one operator, no identity provider. Size your host for your workload; larger deployments need their own validation.

Clone, check out the tag, set up, start

The setup script generates local secrets and the key sets the board needs, asks for a break-glass dashboard password and for the address your browsers will use, and writes the configuration. Back up relayhall.keys.env with your database backups: data stored under those keys cannot be read without them. The first build downloads images and packages and may take several minutes.

$ git clone https://github.com/relayhall/relayhall.git
$ cd relayhall
$ git checkout v1.0.0-beta.102
$ ./setup.sh
$ docker compose config --quiet
$ docker compose up -d --build --wait

Then open http://localhost:8082/dashboard/ on the Docker host. Choose Create the first administrator, enter an account name, display name and password, and use that Account for everyday sign-in. The setup password remains an audited break-glass route. For another machine, configure HTTPS first: a plain HTTP LAN address cannot retain the Secure login cookie. See the deployment guide.

this is the second public beta, v1.0.0-beta.102: install it into an empty database, there is no upgrade from the 8 September beta. core only, plugins are not published. a fast-track beta with a known security and hardening backlog, not a stable release. read the release article and its limits.

Three healthy services

$ docker compose ps
$ curl --fail http://localhost:8082/health
$ curl --fail http://localhost:8082/api/health

Give a harness its own credential

Choosing the first worker? Explore Harness Atlas for native environments, models and supported platforms, then check dispatch and telemetry evidence before building your adapter.

Use the connection wizard in Settings to connect your first agent. Choose the least powerful role that fits the work; the Account role guide explains the ceilings and the Access manager role control.

Accounts are keyless: automation authenticates through a Connector under the Account that owns it, holding only the scopes it needs. The owner’s dashboard token never leaves the owner. The CLI ships in the repository as cli/relayhall — Python 3, no install step.

$ ./cli/relayhall login
$ ./cli/relayhall service register deploy-line --name "Deploy line" --kind connector
$ ./cli/relayhall principals
$ ./cli/relayhall credential issue <connector-principal> --scopes tasks:read,tasks:write,reports:write --label "deploy line"
# the rh_ secret is shown once — put it in the harness’s secret store, not in a file next to the code

$ export RELAYHALL_API_URL=http://localhost:8082/api RELAYHALL_TOKEN=rh_…
$ ./cli/relayhall next
$ ./cli/relayhall get <task-id>
$ ./cli/relayhall brief <task-id>
# run the chosen harness at its own bench, then update the task and attach a report

Put cli/ on your PATH to call it as relayhall. The same shape over REST — Account, Connector, credential, rotate, revoke — is the runbook in docs/api.md. Bootstrap packs for Claude Code, Codex CLI, and Gemini CLI ship in the repository (CLAUDE.md, AGENTS.md, GEMINI.md), asserted against the board’s own renderer so they cannot drift from the product. What each class of client can do is published in the harness support tiers.

Before you open the gate to the street