> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Glossary

> Plain-language definitions of Data Relay Link terms for beginners and operators.

# Glossary

Use this page when a guide uses a term you do not recognize.

| Term                       | Meaning                                                                                                                  |
| -------------------------- | ------------------------------------------------------------------------------------------------------------------------ |
| **Data Relay Link**        | Lightweight secure-connectivity product for selected remote access and controlled outbound connectivity.                 |
| **Data Relay Link Server** | Linux public entry point running the relay runtime plus enrollment, management, policy, audit, and lifecycle components. |
| **Client**                 | Remote machine running the Data Relay Link client runtime and persistent management identity.                            |
| **Relay engine**           | Bundled low-level transport runtime used to carry remote-access relay sessions.                                          |
| **Relay token**            | Credential used to authenticate relay transport; separate from enrollment and management credentials.                    |
| **CLIENT ID**              | Immutable machine identity used by the server for canonical administration.                                              |
| **Label**                  | Human-friendly client name. It can change without changing CLIENT ID.                                                    |
| **Hostname**               | Operating-system hostname reported/displayed for a client; not canonical identity.                                       |
| **Tag**                    | Administrator metadata used to classify a client.                                                                        |
| **Service**                | One published TCP target, such as SSH or a web application.                                                              |
| **Service ID**             | Stable identifier for a service on a client, such as `ssh` or `web-admin`.                                               |
| **Target host / port**     | Where the client forwards a published connection, for example `127.0.0.1:22` or `10.10.20.30:443`.                       |
| **Public service port**    | Internet-facing TCP port assigned to a service on the Data Relay Link Server. It is treated as a persistent reservation. |
| **Enrollment**             | Secure first-time pairing of a client with the server.                                                                   |
| **Enrollment Code**        | Short-lived secret used during manual enrollment.                                                                        |
| **Bootstrap Ticket**       | Short-lived secret used by Zero-Touch enrollment.                                                                        |
| **Zero-Touch**             | Onboarding method where the server prepares the profile and the remote user runs one generated command.                  |
| **Allocator**              | Server-side enrollment/management HTTPS component that coordinates enrollment and service-port assignment.               |
| **Project private CA**     | CA maintained by Data Relay Link to establish and verify management HTTPS trust.                                         |
| **Direct mode**            | Default server mode with relay control and enrollment HTTPS exposed on separate public endpoints.                        |
| **single-443**             | Deployment mode that carries enrollment HTTPS and relay control/WSS through public TCP/443.                              |
| **Public hostname**        | Optional DNS alias for user-facing published-service access.                                                             |
| **Controlled Egress**      | Agentless HTTP/HTTPS outbound relay that allows only server-policy-approved destinations.                                |
| **Egress policy**          | Source network, destination FQDN, destination port, wildcard, and deny rules applied to Controlled Egress.               |
| **Default deny**           | Policy behavior where traffic is rejected unless an explicit allow rule matches.                                         |
| **Fail closed**            | Safety behavior where policy/configuration/authentication failure results in denial rather than broad access.            |
| **Disable**                | Stop a service temporarily while keeping its public-port reservation.                                                    |
| **Release**                | Return a public service-port reservation to the pool.                                                                    |
| **Revoke**                 | Block a management identity or active enrollment credential; does not mean release.                                      |
| **Doctor**                 | Read-only `drlink` diagnostics that checks installation, trust, state, services, policy, and network consistency.        |

<Note>
  Important distinctions: **CLIENT ID vs label/hostname**, **disable vs release**, and **relay token vs enrollment/management credentials**.
</Note>