Español · Українська

Report Relay

Report Relay accepts the security reports browsers and mail servers send — Reporting API batches, legacy CSP report-uri bodies, network error logs and SMTP TLS reports — and emits one OpenTelemetry log record per report, so they land in the existing Loki, Tempo and Grafana stack instead of a separate collector per report type.

Features

• A slow collector never slows a browser
• CAA IODEF incident reports
• Cross-Origin-Embedder-Policy reports
• Dropped into an OpenTelemetry setup unchanged
• Cross-Origin-Opener-Policy reports
• Browser crash reports
• Legacy CSP report-uri reports
• Content Security Policy violation reports
• Deprecation reports
• Document Policy violation reports
• Expect-CT violation reports
• A public intake, guarded by default
• HPKP pin validation failure reports
• Subresource Integrity violation reports
• Browser intervention reports
• Network Error Logging reports
• One endpoint for every report a site can send
• Permissions Policy violation reports
• SMTP TLS reports
• Typo reports from your readers
• A report type nobody has defined yet is still kept

It also inherits the features of B19 / Ubuntu — see Features for the full list.

What this provides

• Executable report-relay — command report-relay
• Container image ghcr.io/damian-buho/report-relay:latest
• Container image damianbuho/report-relay:latest
• Service relay — listens on 8080 (intake), 8081 (admin) — Report intake and health endpoints

Installation

Container image

Pull the published container image:

Pull from GHCR — linux/amd64, linux/arm64

docker pull ghcr.io/damian-buho/report-relay:latest

Pull from DockerHub — linux/amd64

docker pull damianbuho/report-relay:latest

Stable releases also publish X.Y.Z, X.Y and X tags — pull the precision you want to pin.

If the registries above are unreachable, pull from the origin instead:

Pull from Kiota — linux/amd64

docker pull kiota.ch/damian-buho/report-relay:latest

Prebuilt binary

Download the prebuilt binary for your platform from GitHub Releases:

mkdir -p ~/.local/bin
curl --fail --location --output ~/.local/bin/report-relay https://github.com/damian-buho/report-relay/releases/latest/download/report-relay-linux-$(uname -m)
chmod +x ~/.local/bin/report-relay
~/.local/bin/report-relay --help

Published for: linux/amd64, linux/arm64, linux/riscv64

Usage

Run the service in the background, publishing its ports:

From GHCR

docker run --detach --publish 8080:8080/tcp --publish 8081:8081/tcp ghcr.io/damian-buho/report-relay:latest

From DockerHub

docker run --detach --publish 8080:8080/tcp --publish 8081:8081/tcp damianbuho/report-relay:latest

Then check that it answers:

curl http://localhost:8081/healthz

Building

Clone the repository with its submodules:

git clone --recurse-submodules https://codeberg.org/damian-buho/report-relay report-relay && cd report-relay

Build the container image locally:

make container-build

• Makefile reference

Run make with no arguments for the default target; run make help to list every target.

For the local dev loop, make dev-container brings up the dev-container.

Pipeline entry points:

• make analyzed — Run the heavy analysis sweep (mutation testing, benchmarks)
• make audited — Re-scan the pinned dependencies and published artifacts for new vulnerabilities
• make check-outdated — Report every pinned dependency that lags upstream
• make ready-to-publish — Run the pseudo-CI pipeline locally — build, test and scan, without publishing

Documentation

• Collect typo reports from your site

Policies

• How to contribute
• Security policy
• Getting support
• Code of Conduct
• AI and LLM Policy

Links

• Projectfile Specification

License

This project is licensed under MIT — see the LICENSE file for details.