05 — Architecture

The relay
architecture

Two layers. That is all that is required for the general case.

The two layers

1
Layer 1 — MASQUE Relay

2
Layer 2 — mTLS & ACME Device Attestation

MDM mobileconfig profile Client macOS / iOS MDM-managed ACME cert in SE MASQUE Relay h2o · Docker · Linux VM relay.example.com · mTLS Static public IP Your network Private VNet / VPC / on-prem Relay terminates here VDI Gateway Citrix / Horizon / RDP Internal App Web · API · Browser Anything with a DNS name PKI Root / Intermediate CA profile QUIC+mTLS CONNECT trust chain LAYER 1: MASQUE · LAYER 2: mTLS

Deployment options for the relay

Private cloud

On-premises + public relay

Existing private endpoint