# Install the Texa Relay For your IT team. Run the Texa Relay inside your network, sign its file, enrol it and keep it running. !!! note "On request" Texa sets up each company's Relay address and gives you the program (a Linux binary, or a container image). Ask [info@texadesk.com](mailto:info@texadesk.com) to start. The Texa Relay lets Texa AI look things up in your systems (a transfer's status, an account's state, a customer's accounts) **without your data or credentials leaving your network** and **without opening any inbound port**. It runs on a server of yours, connects *out* to Texa over mutual TLS, and runs only the operations your administrator has written, reviewed and signed. ## What it can and cannot do - It runs **only the named operations in your signed file**: a `SELECT` your team wrote, or a call to one of your internal services. Texa sends an operation's name and values for its declared parameters, never SQL, a URL or a header. - **Queries must be read-only.** Each is checked to be a single `SELECT`. The database login must be read-only; the Relay checks this at start and refuses to run otherwise. Every query runs in a read-only transaction. - **Limits you set:** rows, time, response size, requests a minute, and how many run at once. - **Masking:** account numbers cut to the last four digits, card numbers to the first six and last four, BVN and NIN hashed, dates of birth to the year. Set per column, or by column name across all queries. - **Customer checks:** an operation can require that Texa has verified the customer first. A customer's own phone number or email comes from Texa's record of who is writing, never from what the AI chose. - **An audit log on your disk:** every request and its outcome (not the data returned), hash-chained so a changed or removed line shows. `texa-relay audit` verifies it. - **A kill switch on your side:** create the file `/var/lib/texa-relay/KILL`, or send `SIGUSR1`. Every running request stops, and nothing runs until the file is removed. Texa cannot lift your switch. Texa has its own switch, which cannot lift yours. ## What you need - A Linux server or VM (2 vCPU, 1 GB of memory is plenty), or any Docker host. - Outbound HTTPS (443) to the Relay address Texa gives you. Nothing inbound. A proxy is supported (`hub.proxy`). - A **read-only** login for each database, ideally on a reporting replica. - For internal services: their addresses and a token, in environment variables (never in the file). ## Setting it up 1. **Make your administrator's signing key.** Keep the private key off the Relay server, with the person who approves changes. ```bash texa-relay keygen --out ./relay-admin # admin.key (keep safe), admin.pub ``` 2. **Write the file** `/etc/texa-relay/relay.yaml`. Start from the template for your core banking system (`templates/finacle.yaml`, `templates/t24.yaml` or `templates/flexcube.yaml`). Confirm every table and service with your team, and delete what you do not allow. Connection strings come from environment variables (`dsn_env`), never from the file. A file with one operation looks like this (from the Finacle template): ```yaml serial: 1 name: pilotbank-finacle hub: {url: ""} databases: finacle: driver: oracle dsn_env: FINACLE_REPLICA_DSN # a read-only login on a reporting replica mask_columns: "*bvn*": hash "*nin*": hash queries: account_status: description: Whether an account is open, frozen or closed, and its scheme database: finacle sql: | SELECT foracid, acct_cls_flg, frez_code, schm_code FROM tbaadm.gam WHERE foracid = :account params: account: {type: text, pattern: "[0-9]{10}", description: the NUBAN} outputs: foracid: {type: text} acct_cls_flg: {type: text, description: Y when closed} frez_code: {type: text, description: "a freeze code, blank when none"} schm_code: {type: text} mask: {foracid: last4} requires_verified: true ``` Texa gives you the templates for Finacle, Temenos Transact (T24) and Oracle FLEXCUBE with the program. 3. **Sign it,** on the administrator's machine. Signing checks the file first and lists every problem at once; nothing is signed until there are none: ```bash texa-relay sign --key admin.key relay.yaml # writes relay.yaml.sig ``` Copy `relay.yaml`, `relay.yaml.sig` and `admin.pub` to `/etc/texa-relay/`. Every later change raises `serial` and is signed again. The Relay refuses an older serial, so a removed query cannot be brought back by restoring an old file. 4. **Enrol.** In Texa Desk, under **Texa AI → Actions → Relay**, add a relay. You get a one-time token that lasts 24 hours. On the Relay server: ```bash texa-relay enrol --hub --token ``` The Relay makes its own key on your server and asks Texa to sign a certificate. The key never leaves the server. Certificates last 30 days and renew by themselves. Then check everything the Relay checks when it starts (the signature, the file, each database login is read-only, the certificate), without serving anything: ```bash texa-relay check ``` 5. **Run it,** as a service: ```ini # /etc/systemd/system/texa-relay.service [Service] ExecStart=/usr/local/bin/texa-relay run EnvironmentFile=/etc/texa-relay/secrets.env User=texa-relay Restart=always RestartForceExitStatus=75 ``` or in Docker: ```bash docker run -d --name texa-relay --restart always \ -v /etc/texa-relay:/etc/texa-relay:ro -v texa-relay-state:/var/lib/texa-relay \ --env-file /etc/texa-relay/secrets.env ``` 6. **Bind operations to actions.** Texa Desk shows the relay connected, with the operations your signed file offers. Your team binds each one to the Texa AI action it answers. Texa routes nothing else. The first connection records the key your file is signed with. If a later file is signed with a **different** key, Texa refuses the relay until a person accepts the new key in Texa Desk, so a file signed by anyone else cannot slip in. ## Running it - `texa-relay audit` verifies the audit log's chain and names the first broken line. - Health (databases reachable, requests, refusals, the audit head) is sent to Texa every 15 seconds and shown in Texa Desk. - **Updates** are off unless your file turns them on (`update.enabled`). When on, the Relay installs only a release signed with Texa's release key built into it. It checks the release's hash, never downgrades, keeps the previous binary, and restarts. In Docker, pull the new image instead. - Exit status 75 means "updated, restart me". The systemd unit above does that. How the Relay is built, its protocol and its threat model are in the [security overview](/hosting/security); ask [info@texadesk.com](mailto:info@texadesk.com) for the full design document for your security review.