Cloud relay

The cloud relay (the native Rust ados-cloud service) lets you monitor and control a drone from outside its network. It works behind NAT, through firewalls and over cellular, with no port forwarding: every connection is outbound. The relay is opt-in and off by default. On the same LAN, Mission Control reaches the agent directly (see Pairing).

The relay carries flight commands to the drone from anywhere. Read Safety before you fly a drone you reach over the relay, and turn on MAVLink signing.

What crosses the relay

Traffic	Path	Cadence
Status heartbeat	HTTPS `POST {convex}/agent/status`	Every 5 s (fixed)
Command queue	HTTPS poll of the Convex backend	Every 5 s
Raw MAVLink	MQTT `ados/{deviceId}/mavlink/tx` (drone to GCS) and `ados/{deviceId}/mavlink/rx` (GCS to drone), QoS 0	Continuous
Raw MSP	MQTT `ados/{deviceId}/msp/tx` and `ados/{deviceId}/msp/rx`, QoS 0	Continuous
Video signaling	MQTT `ados/{deviceId}/webrtc/offer` (subscribed) and `ados/{deviceId}/webrtc/answer/{sessionId}` (published), QoS 1	Per session
Vision detections	MQTT `ados/{deviceId}/vision/detections`	When an extension publishes
Extension streams	MQTT `ados/{deviceId}/plugin/{plugin_id}/{stream}`, QoS 0	When an extension publishes
Extension updates	MQTT `ados/{deviceId}/plugin/update_available`, QoS 1	When an update needs a decision
Video	WebRTC peer to peer between the drone and the browser	Live

The relay bridges the raw MAVLink stream to the broker so a remote Mission Control decodes it in the browser, exactly as it does over the LAN WebSocket. There is no separate telemetry topic.

Video signaling

Mission Control publishes an SDP offer to ados/{deviceId}/webrtc/offer, tagged with its session id.
ados-cloud POSTs the offer to the local MediaMTX WHEP endpoint.
MediaMTX returns an SDP answer.
ados-cloud publishes the answer to ados/{deviceId}/webrtc/answer/{sessionId}.
The browser and the drone connect peer to peer, and video flows directly between them.

The number of concurrent sessions is capped, and a session is torn down when the browser closes it. MQTT carries only the handshake. A network that blocks peer-to-peer WebRTC (for example a symmetric-NAT cellular carrier) still gets telemetry and commands over MQTT, but no video.

Connection modes

Local / cloud-off (default)
Cloud
Self-hosted

No cloud connectivity. The MAVLink proxy, video and REST API all work locally; only remote access is off.

server:
  mode: "local"

Use this for air-gapped work, bench testing or LAN-only flying.

Opt-in; choose it in the dashboard Settings > Cloud. Connects to the hosted backend: MQTT over WSS on port 443, and Convex HTTP actions over HTTPS.

server:
  mode: "cloud"
  cloud:
    url: "https://convex-site.altnautica.com"
    mqtt_broker: "mqtt.altnautica.com"
    mqtt_port: 443

Connects to your own MQTT broker and Convex backend.

server:
  mode: "self_hosted"
  self_hosted:
    url: "https://convex.example.com"
    mqtt_broker: "mqtt.example.com"
    mqtt_port: 8883
    api_key: "your-api-key"

You run the MQTT broker and the Convex backend. See Self-hosting: MQTT broker.

All server.* keys:

Key	Type	Default	Allowed	Description
`server.cloud.mqtt_broker`	string	`"mqtt.altnautica.com"`	n/a	Mqtt Broker
`server.cloud.mqtt_port`	integer	`443`	0 to 65535	Mqtt Port
`server.cloud.url`	string	`"https://convex-site.altnautica.com"`	n/a	Url
`server.cloud_logs_enabled`	boolean	`false`	n/a	Cloud Logs Enabled
`server.mode`	string	`"local"`	`"cloud"`, `"self_hosted"`, `"local"`	Mode
`server.mqtt_transport`	string	`"websockets"`	n/a	Mqtt Transport
`server.self_hosted.api_key`	string	Secret, not shown	n/a	Api Key
`server.self_hosted.mqtt_broker`	string	`""`	n/a	Mqtt Broker
`server.self_hosted.mqtt_port`	integer	`8883`	0 to 65535	Mqtt Port
`server.self_hosted.url`	string	`""`	n/a	Url

MQTT transport

ados-cloud uses rumqttc over WSS/TLS (system webpki roots), QoS 0 for the MAVLink plane and QoS 1 for WebRTC signaling, and a bounded publish queue that drops when the broker is down. Each lane holds its own broker session with its own ClientID (ados-{deviceId} for MAVLink, ados-{deviceId}-msp, ados-{deviceId}-webrtc, ados-{deviceId}-plugin-publish, ados-{deviceId}-plugin-update), so the lanes never evict each other. A dropped session reconnects every 3 seconds and resubscribes on every reconnect.

Heartbeat

While paired, the agent POSTs its status to {convex}/agent/status every 5 s (fixed, not configurable), authenticated by its X-ADOS-Key. Mission Control reads the status row to show the drone online and to fill the per-drone view.

Security

MQTT uses WebSocket over TLS (wss://, port 443) in cloud mode.
Convex HTTP uses HTTPS.
WebRTC media is encrypted with DTLS-SRTP.
The agent authenticates with the API key it received at pairing.

No inbound ports are required on the drone’s network.

Checking cloud status

From the CLI:

ados status --json | python3 -c "import sys,json; print(json.load(sys.stdin).get('cloud_choice', {}))"

cloud_choice carries mode, backend_url and paired. Plain ados status prints the same as a Cloud relay line. From the REST API:

curl http://localhost:8080/api/status \
  -H "X-ADOS-Key: your_key"

Next steps

Cloud infrastructure

Backend architecture and the full MQTT topic reference.

Self-hosting

Run the broker, bridge and backend yourself.

MAVLink signing

Protect commands that travel over the relay.

Battery health

Per-pack health computed on the drone.

Get started

Set up and use

Link, video and flight systems

Reference

Diagnose

What crosses the relay

Video signaling

Connection modes

MQTT transport

Heartbeat

Security

Checking cloud status

Next steps

Cloud infrastructure

Self-hosting

MAVLink signing

Battery health

​What crosses the relay

​Video signaling

​Connection modes

​MQTT transport

​Heartbeat

​Security

​Checking cloud status

​Next steps

Cloud infrastructure

Self-hosting

MAVLink signing

Battery health

What crosses the relay

Video signaling

Connection modes

MQTT transport

Heartbeat

Security

Checking cloud status

Next steps