release: v0.1.11

Author: zengyufei

CHANGELOG.en.md

@@ -6,6 +6,22 @@ All notable changes to `ii` are documented here. The default Chinese version is
 
 Nothing yet.
 
+## 0.1.11 - 2026-07-17
+
+### Added
+
+- Added `ii relay --public <https-url>` to generate and persist a self-signed HTTPS relay certificate.
+- Added `ii send --relay <https-url> -k` to trust a self-signed relay and carry that policy in the ticket for receivers.
+
+### Changed
+
+- Made explicit `--relay` sends and receives relay-only, without UDP, LAN discovery, or direct paths.
+- Kept normal system TLS verification for manual TLS relays; first use of a self-signed relay can still be replaced by a man-in-the-middle.
+
+### Documentation
+
+- Updated self-signed relay, manual TLS, port, state-file, and security-boundary guidance.
+
 ## 0.1.10 - 2026-07-17
 
 ### Changed

CHANGELOG.md

@@ -6,6 +6,22 @@
 
 暂无。
 
+## 0.1.11 - 2026-07-17
+
+### 新增
+
+- `ii relay --public <https-url>` 自动生成并持久化自签 HTTPS relay 证书。
+- `ii send --relay <https-url> -k` 接受自签 relay，并把该信任策略写入 ticket，接收端无需额外配置。
+
+### 变更
+
+- 指定 `--relay` 时发送和接收都强制 relay-only，不再尝试 UDP、局域网发现或点对点直连。
+- 手工 TLS relay 继续使用系统证书验证；自签 relay 的首次连接仍可能遭遇中间人替换。
+
+### 文档
+
+- 更新自签 relay、手工 TLS、端口、状态文件和安全边界说明。
+
 ## 0.1.10 - 2026-07-17
 
 ### 变更

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "ii"
-version = "0.1.10"
+version = "0.1.11"
 edition = "2024"
 rust-version = "1.91"
 license = "MIT"
@@ -17,21 +17,20 @@ postcard = { version = "1", features = ["use-std"] }
 rustls = { version = "0.23.33", default-features = false, features = ["ring"] }
 s3 = { package = "rust-s3", path = "vendor/rust-s3", default-features = false, features = ["sync-rustls-tls"] }
 reqwest_dav = { version = "0.3.3", default-features = false, features = ["rustls-tls-no-provider"] }
+rcgen = { version = "0.14", default-features = false, features = ["crypto", "pem", "ring"] }
 serde = { version = "1", features = ["derive"] }
 tar = { version = "0.4", default-features = false }
 tempfile = "3"
 tokio = { version = "1", features = ["fs", "io-std", "io-util", "macros", "net", "rt-multi-thread", "signal", "time"] }
 tokio-util = { version = "0.7", features = ["io"] }
 toml = "1.0"
+tracing = "0.1"
+tracing-subscriber = { version = "0.3", default-features = false, features = ["ansi", "env-filter", "fmt", "std"] }
 url = { version = "2.5", features = ["serde"] }
 
 [build-dependencies]
 winresource = "0.1"
 
-[features]
-default = []
-relay-metrics = ["iroh-relay/metrics"]
-
 [profile.release]
 codegen-units = 1
 lto = "fat"

Cargo.toml

@@ -179,31 +179,40 @@ ii version
 
 You do not need to understand relay hosting to send ordinary files. This section is only for running your own relay service or using a fixed relay entrypoint in a company network.
 
-Start a relay:
+Start a self-signed HTTPS relay:
 
 ```powershell
-ii relay
+ii relay --public https://SERVER_PUBLIC_IP:8443
 ```
 
-The default is an HTTP-only relay:
+You can use a domain too:
 
-- It listens on `0.0.0.0:3340`; only allow `3340/tcp`.
-- Use the server's public IP directly. No domain, DNS, or certificate is required.
-- HTTPS, QUIC, and metrics do not start.
+```powershell
+ii relay --public https://relay.example.com
+```
 
-Clients use it with:
+`--public` is the public HTTPS address used by clients and must be `https://host[:port]`. On first start, `ii` generates and persists a self-signed certificate and key in the relay state directory. It listens on the public URL port, or on `443` when the URL has no port. Use `-H` for a different local backend port behind NAT or a reverse proxy:
 
 ```powershell
-ii send .\video.mp4 --relay http://SERVER_PUBLIC_IP:3340
+ii relay --public https://relay.example.com:8443 -H 9443
 ```
 
-For HTTPS and a domain, explicitly provide an existing certificate and private key:
+Send through the relay:
+
+```powershell
+ii send .\video.mp4 --relay https://SERVER_PUBLIC_IP:8443 -k
+```
+
+`-k` accepts the self-signed certificate and puts that policy in the ticket; the receiver needs no certificate installation or relay configuration. A first connection can still be replaced by a man-in-the-middle.
+
+With a domain and PEM certificate files, use manual TLS:
 
 ```powershell
 ii relay --tls relay.example.com -H 8443 --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
+ii send .\video.mp4 --relay https://relay.example.com:8443
 ```
 
-Clients use `https://relay.example.com:8443`. `ii` does not issue or renew certificates; the operator owns those files. See [ii.md](ii.md) for the full configuration. Plain HTTP is not suitable for a long-lived public deployment.
+Manual TLS does not use `-k`; clients use normal system TLS verification. Both `--relay` modes force HTTPS relay-only transport and skip UDP and direct paths. See [ii.md](ii.md) for ports, state paths, and the security boundary.
 
 ## Full Manual
 
@@ -215,7 +224,7 @@ Release changes are documented in [CHANGELOG.en.md](CHANGELOG.en.md). The defaul
 
 ## Version
 
-The current version is managed by Git tags. This repository currently uses `v0.1.10`.
+The current version is managed by Git tags. This repository currently uses `v0.1.11`.
 
 ## License
 

README.en.md

@@ -190,31 +190,40 @@ ii version
 
 普通发文件不需要先理解 relay。只有你要自建中继服务，或者公司网络环境需要固定中继入口时，才需要看这一段。
 
-启动 relay：
+启动自签 HTTPS relay：
 
 ```powershell
-ii relay
+ii relay --public https://服务器公网IP:8443
 ```
 
-默认就是 HTTP relay：
+也可以使用域名：
 
-- 监听 `0.0.0.0:3340`，只需要开放 `3340/tcp`
-- 直接填服务器公网 IP，不需要域名、DNS 或证书
-- 不启动 HTTPS、QUIC 和 metrics
+```powershell
+ii relay --public https://relay.example.com
+```
 
-客户端使用：
+`--public` 是客户端实际访问的公网 HTTPS 地址，必须是 `https://主机[:端口]`。首次启动会自动在 relay 状态目录生成并持久化自签证书和私钥。默认监听 `--public` 的端口，未写端口就是 `443`；NAT 或反向代理需要转到不同后端端口时，用 `-H`：
 
 ```powershell
-ii send .\video.mp4 --relay http://服务器公网IP:3340
+ii relay --public https://relay.example.com:8443 -H 9443
 ```
 
-需要 HTTPS 和域名时，显式提供已有证书和私钥：
+发送端指定 relay：
+
+```powershell
+ii send .\video.mp4 --relay https://服务器公网IP:8443 -k
+```
+
+`-k` 表示接受自签证书，并把该策略带进 ticket；接收方无需安装证书或配置 relay。首次连接仍可能遭遇中间人替换。
+
+已有域名和 PEM 证书时，使用手工证书模式：
 
 ```powershell
 ii relay --tls relay.example.com -H 8443 --cert D:\certs\fullchain.pem --key D:\certs\privkey.pem
+ii send .\video.mp4 --relay https://relay.example.com:8443
 ```
 
-客户端使用 `https://relay.example.com:8443`。`ii` 不申请、不续期证书；证书文件由运维方负责。完整配置见 [ii.md](ii.md)。纯 HTTP 不适合不受信任的公网长期部署。
+手工证书模式不带 `-k`，客户端使用系统正常 TLS 校验。两种 `--relay` 都只走 HTTPS relay，不尝试 UDP 或直连；完整端口、状态路径和安全边界见 [ii.md](ii.md)。
 
 ## 详细手册
 
@@ -226,7 +235,7 @@ ii relay --tls relay.example.com -H 8443 --cert D:\certs\fullchain.pem --key D:\
 
 ## 版本
 
-当前版本由 Git tag 管理。仓库内已使用 `v0.1.10`。
+当前版本由 Git tag 管理。仓库内已使用 `v0.1.11`。
 
 ## 许可证