misc: addressed comments

backend/src/db/migrations/20250825131627_add-gateway-v2-pki-and-ssh-configs.ts

@@ -98,8 +98,10 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("identityId");
       t.foreign("identityId").references("id").inTable(TableName.Identity).onDelete("CASCADE");
 
-      t.string("name").notNullable().unique();
+      t.string("name").notNullable();
-      t.string("ip").notNullable();
+      t.string("host").notNullable();
+
+      t.unique(["orgId", "name"]);
     });
 
     await createOnUpdateTrigger(knex, TableName.Relay);
@@ -119,7 +121,9 @@ export async function up(knex: Knex): Promise<void> {
       t.uuid("relayId");
       t.foreign("relayId").references("id").inTable(TableName.Relay).onDelete("SET NULL");
 
-      t.string("name").notNullable().unique();
+      t.string("name").notNullable();
+
+      t.unique(["orgId", "name"]);
 
       t.dateTime("heartbeat");
     });

backend/src/db/schemas/relays.ts

@@ -14,7 +14,7 @@ export const RelaysSchema = z.object({
   orgId: z.string().uuid().nullable().optional(),
   identityId: z.string().uuid().nullable().optional(),
   name: z.string(),
-  ip: z.string()
+  host: z.string()
 });
 
 export type TRelays = z.infer<typeof RelaysSchema>;

backend/src/ee/routes/v1/relay-router.ts

@@ -18,7 +18,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        ip: z.string(),
+        host: z.string(),
         name: z.string()
       }),
       response: {
@@ -68,7 +68,7 @@ export const registerRelayRouter = async (server: FastifyZodProvider) => {
     },
     schema: {
       body: z.object({
-        ip: z.string(),
+        host: z.string(),
         name: z.string()
       }),
       response: {

backend/src/ee/services/dynamic-secret/providers/kubernetes.ts

@@ -79,7 +79,7 @@ export const KubernetesProvider = ({
           );
         },
         {
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp,

backend/src/ee/services/dynamic-secret/providers/sql-database.ts

@@ -203,7 +203,7 @@ export const SqlDatabaseProvider = ({
           await gatewayCallback("localhost", port);
         },
         {
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           protocol: GatewayProxyProtocol.Tcp

backend/src/ee/services/gateway-v2/gateway-v2-service.ts

@@ -25,7 +25,6 @@ import { TLicenseServiceFactory } from "../license/license-service";
 import { OrgPermissionGatewayActions, OrgPermissionSubjects } from "../permission/org-permission";
 import { TPermissionServiceFactory } from "../permission/permission-service-types";
 import { TRelayDALFactory } from "../relay/relay-dal";
-import { isInstanceRelay } from "../relay/relay-fns";
 import { TRelayServiceFactory } from "../relay/relay-service";
 import { GATEWAY_ACTOR_OID, GATEWAY_ROUTING_INFO_OID } from "./gateway-v2-constants";
 import { TGatewayV2DALFactory } from "./gateway-v2-dal";
@@ -399,7 +398,7 @@ export const gatewayV2ServiceFactory = ({
     });
 
     return {
-      relayIp: relayCredentials.relayIp,
+      relayHost: relayCredentials.relayHost,
       gateway: {
         clientCertificate: clientCert.toString("pem"),
         clientPrivateKey: gatewayClientCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
@@ -429,11 +428,9 @@ export const gatewayV2ServiceFactory = ({
     await $validateIdentityAccessToGateway(orgId, actorId, actorAuthMethod);
     const orgCAs = await $getOrgCAs(orgId);
 
-    let relay: TRelays;
+    let relay: TRelays = await relayDAL.findOne({ orgId, name: relayName });
-    if (isInstanceRelay(relayName)) {
+    if (!relay) {
-      relay = await relayDAL.findOne({ name: relayName });
+      relay = await relayDAL.findOne({ name: relayName, orgId: null });
-    } else {
-      relay = await relayDAL.findOne({ orgId, name: relayName });
     }
 
     if (!relay) {
@@ -515,7 +512,7 @@ export const gatewayV2ServiceFactory = ({
 
       return {
         gatewayId: gateway.id,
-        relayIp: relayCredentials.relayIp,
+        relayHost: relayCredentials.relayHost,
         pki: {
           serverCertificate: gatewayServerCertificate.toString("pem"),
           serverPrivateKey: gatewayServerCertPrivateKey.export({ format: "pem", type: "pkcs8" }).toString(),
@@ -613,7 +610,7 @@ export const gatewayV2ServiceFactory = ({
       },
       {
         protocol: GatewayProxyProtocol.Ping,
-        relayIp: gatewayV2ConnectionDetails.relayIp,
+        relayHost: gatewayV2ConnectionDetails.relayHost,
         gateway: gatewayV2ConnectionDetails.gateway,
         relay: gatewayV2ConnectionDetails.relay
       }

backend/src/ee/services/relay/relay-fns.ts

@@ -1,5 +0,0 @@
-export const INSTANCE_RELAY_PREFIX = "infisical-";
-
-export const isInstanceRelay = (relayName: string) => {
-  return relayName.startsWith(INSTANCE_RELAY_PREFIX);
-};

backend/src/ee/services/relay/relay-service.ts

@@ -19,7 +19,6 @@ import { SshCertKeyAlgorithm } from "../ssh-certificate/ssh-certificate-types";
 import { TInstanceRelayConfigDALFactory } from "./instance-relay-config-dal";
 import { TOrgRelayConfigDALFactory } from "./org-relay-config-dal";
 import { TRelayDALFactory } from "./relay-dal";
-import { isInstanceRelay } from "./relay-fns";
 
 export type TRelayServiceFactory = ReturnType<typeof relayServiceFactory>;
 
@@ -588,7 +587,7 @@ export const relayServiceFactory = ({
   };
 
   const $generateRelayServerCredentials = async ({
-    ip,
+    host,
     orgId,
     relayPkiServerCaCertificate,
     relayPkiServerCaPrivateKey,
@@ -597,7 +596,7 @@ export const relayServiceFactory = ({
     relaySshClientCaPublicKey,
     relaySshServerCaPrivateKey
   }: {
-    ip: string;
+    host: string;
     relayPkiServerCaCertificate: Buffer;
     relayPkiServerCaPrivateKey: Buffer;
     relayPkiClientCaCertificateChain: Buffer;
@@ -640,13 +639,13 @@ export const relayServiceFactory = ({
       ),
       new x509.ExtendedKeyUsageExtension([x509.ExtendedKeyUsage[CertExtendedKeyUsage.SERVER_AUTH]], true),
       // san
-      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: ip }], false)
+      new x509.SubjectAlternativeNameExtension([{ type: "ip", value: host }], false)
     ];
 
     const relayServerSerialNumber = createSerialNumber();
     const relayServerCertificate = await x509.X509CertificateGenerator.create({
       serialNumber: relayServerSerialNumber,
-      subject: `CN=${ip},O=${orgId ?? "Infisical"},OU=Relay`,
+      subject: `CN=${host},O=${orgId ?? "Infisical"},OU=Relay`,
       issuer: relayServerCaCert.subject,
       notBefore: relayServerCertIssuedAt,
       notAfter: relayServerCertExpireAt,
@@ -665,7 +664,7 @@ export const relayServiceFactory = ({
       caPrivateKey: relaySshServerCaPrivateKey.toString("utf8"),
       clientPublicKey: relayServerSshPublicKey,
       keyId: "relay-server",
-      principals: [`${ip}:2222`],
+      principals: [`${host}:2222`],
       certType: SshCertType.HOST,
       requestedTtl: "30d"
     });
@@ -772,15 +771,15 @@ export const relayServiceFactory = ({
     orgId: string;
     gatewayId: string;
   }) => {
-    let relay: TRelays | null;
+    let relay: TRelays | null = await relayDAL.findOne({
-    if (isInstanceRelay(relayName)) {
+      orgId,
+      name: relayName
+    });
+
+    if (!relay) {
       relay = await relayDAL.findOne({
-        name: relayName
+        name: relayName,
-      });
+        orgId: null
-    } else {
-      relay = await relayDAL.findOne({
-        orgId,
-        name: relayName
       });
     }
 
@@ -794,7 +793,7 @@ export const relayServiceFactory = ({
     const { publicKey: relayClientSshPublicKey, privateKey: relayClientSshPrivateKey } =
       await createSshKeyPair(keyAlgorithm);
 
-    if (isInstanceRelay(relayName)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       const relayClientSshCert = await createSshCert({
         caPrivateKey: instanceCAs.instanceRelaySshClientCaPrivateKey.toString("utf8"),
@@ -806,7 +805,7 @@ export const relayServiceFactory = ({
       });
 
       return {
-        relayIp: relay.ip,
+        relayHost: relay.host,
         clientSshCert: relayClientSshCert.signedPublicKey,
         clientSshPrivateKey: relayClientSshPrivateKey,
         serverCAPublicKey: instanceCAs.instanceRelaySshServerCaPublicKey.toString("utf8")
@@ -824,7 +823,7 @@ export const relayServiceFactory = ({
     });
 
     return {
-      relayIp: relay.ip,
+      relayHost: relay.host,
       clientSshCert: relayClientSshCert.signedPublicKey,
       clientSshPrivateKey: relayClientSshPrivateKey,
       serverCAPublicKey: orgCAs.relaySshServerCaPublicKey.toString("utf8")
@@ -850,7 +849,7 @@ export const relayServiceFactory = ({
       });
     }
 
-    if (isInstanceRelay(relay.name)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       const relayCertificateCredentials = await $generateRelayClientCredentials({
         gatewayId,
@@ -863,7 +862,7 @@ export const relayServiceFactory = ({
 
       return {
         ...relayCertificateCredentials,
-        relayIp: relay.ip
+        relayHost: relay.host
       };
     }
 
@@ -879,17 +878,17 @@ export const relayServiceFactory = ({
 
     return {
       ...relayCertificateCredentials,
-      relayIp: relay.ip
+      relayHost: relay.host
     };
   };
 
   const registerRelay = async ({
-    ip,
+    host,
     name,
     identityId,
     orgId
   }: {
-    ip: string;
+    host: string;
     name: string;
     identityId?: string;
     orgId?: string;
@@ -898,12 +897,6 @@ export const relayServiceFactory = ({
     const isOrgRelay = identityId && orgId;
 
     if (isOrgRelay) {
-      if (isInstanceRelay(name)) {
-        throw new BadRequestError({
-          message: "Org relay name cannot start with 'infisical-'. This is reserved for internal use."
-        });
-      }
-
       relay = await relayDAL.transaction(async (tx) => {
         const existingRelay = await relayDAL.findOne(
           {
@@ -913,7 +906,7 @@ export const relayServiceFactory = ({
           tx
         );
 
-        if (existingRelay && (existingRelay.ip !== ip || existingRelay.name !== name)) {
+        if (existingRelay && (existingRelay.host !== host || existingRelay.name !== name)) {
           throw new BadRequestError({
             message: "Org relay with this machine identity already exists."
           });
@@ -922,7 +915,7 @@ export const relayServiceFactory = ({
         if (!existingRelay) {
           return relayDAL.create(
             {
-              ip,
+              host,
               name,
               identityId,
               orgId
@@ -934,30 +927,25 @@ export const relayServiceFactory = ({
         return existingRelay;
       });
     } else {
-      if (!isInstanceRelay(name)) {
-        throw new BadRequestError({
-          message: "Instance relay name must start with 'infisical-'."
-        });
-      }
-
       relay = await relayDAL.transaction(async (tx) => {
         const existingRelay = await relayDAL.findOne(
           {
-            name
+            name,
+            orgId: null
           },
           tx
         );
 
-        if (existingRelay && existingRelay.ip !== ip) {
+        if (existingRelay && existingRelay.host !== host) {
           throw new BadRequestError({
-            message: "Instance relay with this name already exists with a different IP address"
+            message: "Instance relay with this name already exists with a different host"
           });
         }
 
         if (!existingRelay) {
           return relayDAL.create(
             {
-              ip,
+              host,
               name
             },
             tx
@@ -968,10 +956,10 @@ export const relayServiceFactory = ({
       });
     }
 
-    if (isInstanceRelay(name)) {
+    if (relay.orgId === null) {
       const instanceCAs = await $getInstanceCAs();
       return $generateRelayServerCredentials({
-        ip,
+        host,
         relayPkiServerCaCertificate: instanceCAs.instanceRelayPkiServerCaCertificate,
         relayPkiServerCaPrivateKey: instanceCAs.instanceRelayPkiServerCaPrivateKey,
         relayPkiClientCaCertificate: instanceCAs.instanceRelayPkiClientCaCertificate,
@@ -984,7 +972,7 @@ export const relayServiceFactory = ({
     if (relay.orgId) {
       const orgCAs = await $getOrgCAs(relay.orgId);
       return $generateRelayServerCredentials({
-        ip,
+        host,
         orgId: relay.orgId,
         relayPkiServerCaCertificate: orgCAs.relayPkiServerCaCertificate,
         relayPkiServerCaPrivateKey: orgCAs.relayPkiServerCaPrivateKey,

backend/src/lib/gateway-v2/gateway-v2.ts

@@ -19,23 +19,24 @@ interface IGatewayRelayServer {
 }
 
 const createRelayConnection = async ({
-  relayIp,
+  relayHost,
   clientCertificate,
   clientPrivateKey,
   serverCertificateChain
 }: {
-  relayIp: string;
+  relayHost: string;
   clientCertificate: string;
   clientPrivateKey: string;
   serverCertificateChain: string;
 }): Promise<net.Socket> => {
-  const [targetHost] = await verifyHostInputValidity(relayIp);
+  const [targetHost] = await verifyHostInputValidity(relayHost);
-  const [, portStr] = relayIp.split(":");
+  const [, portStr] = relayHost.split(":");
   const port = parseInt(portStr, 10) || 8443;
 
   const serverCAs = splitPemChain(serverCertificateChain);
   const tlsOptions: tls.ConnectionOptions = {
     host: targetHost,
+    servername: relayHost,
     port,
     cert: clientCertificate,
     key: clientPrivateKey,
@@ -121,13 +122,13 @@ const createGatewayConnection = async (
 
 const setupRelayServer = async ({
   protocol,
-  relayIp,
+  relayHost,
   gateway,
   relay,
   httpsAgent
 }: {
   protocol: GatewayProxyProtocol;
-  relayIp: string;
+  relayHost: string;
   gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
   relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
   httpsAgent?: https.Agent;
@@ -145,7 +146,7 @@ const setupRelayServer = async ({
 
           // Stage 1: Connect to relay with TLS
           const relayConn = await createRelayConnection({
-            relayIp,
+            relayHost,
             clientCertificate: relay.clientCertificate,
             clientPrivateKey: relay.clientPrivateKey,
             serverCertificateChain: relay.serverCertificateChain
@@ -244,17 +245,17 @@ export const withGatewayV2Proxy = async <T>(
   callback: (port: number) => Promise<T>,
   options: {
     protocol: GatewayProxyProtocol;
-    relayIp: string;
+    relayHost: string;
     gateway: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
     relay: { clientCertificate: string; clientPrivateKey: string; serverCertificateChain: string };
     httpsAgent?: https.Agent;
   }
 ): Promise<T> => {
-  const { protocol, relayIp, gateway, relay, httpsAgent } = options;
+  const { protocol, relayHost, gateway, relay, httpsAgent } = options;
 
   const { port, cleanup, getRelayError } = await setupRelayServer({
     protocol,
-    relayIp,
+    relayHost,
     gateway,
     relay,
     httpsAgent

backend/src/services/app-connection/github/github-connection-fns.ts

@@ -105,7 +105,7 @@ export const requestWithGitHubGateway = async <T>(
       },
       {
         protocol: GatewayProxyProtocol.Tcp,
-        relayIp: gatewayConnectionDetails.relayIp,
+        relayHost: gatewayConnectionDetails.relayHost,
         gateway: gatewayConnectionDetails.gateway,
         relay: gatewayConnectionDetails.relay
       }

backend/src/services/app-connection/shared/sql/sql-connection-fns.ts

@@ -142,7 +142,7 @@ export const executeWithPotentialGateway = async <T>(
         },
         {
           protocol: GatewayProxyProtocol.Tcp,
-          relayIp: platformConnectionDetails.relayIp,
+          relayHost: platformConnectionDetails.relayHost,
           gateway: platformConnectionDetails.gateway,
           relay: platformConnectionDetails.relay
         }

backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts

@@ -114,7 +114,7 @@ export const identityKubernetesAuthServiceFactory = ({
         },
         {
           protocol: inputs.reviewTokenThroughGateway ? GatewayProxyProtocol.Http : GatewayProxyProtocol.Tcp,
-          relayIp: gatewayV2ConnectionDetails.relayIp,
+          relayHost: gatewayV2ConnectionDetails.relayHost,
           gateway: gatewayV2ConnectionDetails.gateway,
           relay: gatewayV2ConnectionDetails.relay,
           httpsAgent

docs/cli/commands/relay.mdx

@@ -6,7 +6,7 @@ description: "Relay-related commands for Infisical including proxy components"
 <Tabs>
   <Tab title="Start relay">
     ```bash
-    infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-method>
+    infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
     ```
   </Tab>
 </Tabs>
@@ -25,7 +25,7 @@ The relay system uses SSH reverse tunnels over TCP, eliminating firewall complex
   Run the Infisical relay component. The relay handles network traffic routing and can operate in different modes.
 
 ```bash
-infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-method>
+infisical relay start --type=<type> --host=<host> --name=<name> --auth-method=<auth-method>
 ```
 
 ### Flags
@@ -38,20 +38,23 @@ infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-
 
     ```bash
     # Organization relay (customer-deployed)
-    infisical relay start --type=org --ip=192.168.1.100 --name=my-org-relay
+    infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay
 
     # Instance relay (configured by instance admin)
-    INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay
+    INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
     ```
 
   </Accordion>
 
-  <Accordion title="--ip">
+  <Accordion title="--host">
-    The public IP address of the instance where the relay is deployed. This must be a static public IP that gateways can reach.
+    The host (IP address or hostname) of the instance where the relay is deployed. This must be a static public IP or resolvable hostname that gateways can reach.
 
     ```bash
-    # Example
+    # Example with IP address
-    infisical relay start --ip=203.0.113.100 --type=org --name=my-relay
+    infisical relay start --host=203.0.113.100 --type=org --name=my-relay
+
+    # Example with hostname
+    infisical relay start --host=relay.example.com --type=org --name=my-relay
     ```
 
   </Accordion>
@@ -61,7 +64,7 @@ infisical relay start --type=<type> --ip=<ip> --name=<name> --auth-method=<auth-
 
     ```bash
     # Example
-    infisical relay start --name=my-relay --type=org --ip=192.168.1.100
+    infisical relay start --name=my-relay --type=org --host=192.168.1.100
     ```
 
   </Accordion>
@@ -76,10 +79,10 @@ Shared relay servers that serve all organizations on your Infisical instance. Fo
 
 ```bash
 # Organization relay with Universal Auth (customer-deployed)
-infisical relay start --type=org --ip=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
+infisical relay start --type=org --host=192.168.1.100 --name=my-org-relay --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret>
 
 # Instance relay (configured by instance admin)
-INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --ip=10.0.1.50 --name=shared-relay
+INFISICAL_PROXY_AUTH_SECRET=<secret> infisical relay start --type=instance --host=10.0.1.50 --name=shared-relay
 ```
 
 ### Authentication Methods
@@ -105,7 +108,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
     </ParamField>
 
     ```bash
-      infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=universal-auth --client-id=<client-id> --client-secret=<client-secret> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -129,7 +132,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
 
 
     ```bash
-      infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=kubernetes --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -150,7 +153,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
 
 
     ```bash
-      infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=azure --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -171,7 +174,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
 
 
     ```bash
-      infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=gcp-id-token --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -193,7 +196,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
     </ParamField>
 
     ```bash
-      infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=gcp-iam --machine-identity-id=<machine-identity-id> --service-account-key-file-path=<service-account-key-file-path> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -212,7 +215,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
     </ParamField>
 
       ```bash
-        infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
+        infisical relay start --auth-method=aws-iam --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
       ```
 
   </Accordion>
@@ -234,7 +237,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
     </ParamField>
 
     ```bash
-      infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=oidc-auth --machine-identity-id=<machine-identity-id> --jwt=<oidc-jwt> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -258,7 +261,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
 
 
     ```bash
-      infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --type=org --ip=<ip> --name=<name>
+      infisical relay start --auth-method=jwt-auth --jwt=<jwt> --machine-identity-id=<machine-identity-id> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>
@@ -274,7 +277,7 @@ The Infisical CLI supports multiple authentication methods for organization rela
     </ParamField>
 
     ```bash
-      infisical relay start --token=<token> --type=org --ip=<ip> --name=<name>
+      infisical relay start --token=<token> --type=org --host=<host> --name=<name>
     ```
 
   </Accordion>

docs/documentation/platform/gateways/networking.mdx

@@ -30,7 +30,7 @@ The gateway requires the following outbound connectivity:
 
 **For Instance Relays (Infisical Cloud):** Your firewall must allow outbound connectivity to Infisical-managed relay servers.
 
-**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses.
+**For Organization Relays:** Your firewall must allow outbound connectivity to your own relay server IP addresses or hostnames.
 
 **For Self-hosted Instance Relays:** Your firewall must allow outbound connectivity to relay servers configured by your instance administrator.
 
@@ -42,15 +42,16 @@ The gateway requires the following outbound connectivity:
     connections to the desired relay server IP on port 2222.
   </Tab>
   <Tab title="Organization Relays">
-    You control the relay server IP addresses when deploying your own
+    You control the relay server IP addresses or hostnames when deploying your
-    organization relays. **Firewall requirements:** Allow outbound TCP
+    own organization relays. **Firewall requirements:** Allow outbound TCP
-    connections to your relay server IP on port 2222. For example, if your relay
+    connections to your relay server IP or hostname on port 2222. For example,
-    is at `203.0.113.100`, allow TCP to `203.0.113.100:2222`.
+    if your relay is at `203.0.113.100` or `relay.example.com`, allow TCP to
+    `203.0.113.100:2222` or `relay.example.com:2222`.
   </Tab>
   <Tab title="Self-hosted Instance Relays">
-    Contact your instance administrator for the relay server IP addresses
+    Contact your instance administrator for the relay server IP addresses or
-    configured for your deployment. **Firewall requirements:** Allow outbound
+    hostnames configured for your deployment. **Firewall requirements:** Allow
-    TCP connections to instance relay servers on port 2222.
+    outbound TCP connections to instance relay servers on port 2222.
   </Tab>
 </Tabs>
 
@@ -81,7 +82,7 @@ SSH connections over TCP are stateful and handled seamlessly by all modern firew
 
 Since SSH uses TCP, you only need simple outbound rules:
 
-1. **Allow outbound TCP** to relay servers on port 2222
+1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
 2. **Allow outbound HTTPS** to Infisical API endpoints on port 443
 3. **No inbound rules required** - all connections are outbound only
 
@@ -91,7 +92,7 @@ Since SSH uses TCP, you only need simple outbound rules:
 
 For corporate environments with strict egress filtering:
 
-1. **Allow outbound TCP** to relay servers on port 2222
+1. **Allow outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
 2. **Allow outbound HTTPS** to the Infisical API server on port 443
 3. **No inbound rules required** - all connections are outbound only
 4. **Standard TCP rules** - simple and straightforward configuration
@@ -100,7 +101,7 @@ For corporate environments with strict egress filtering:
 
 Configure security groups to allow:
 
-- **Outbound TCP** to relay servers on port 2222
+- **Outbound TCP** to relay servers (IP addresses or hostnames) on port 2222
 - **Outbound HTTPS** to app.infisical.com/eu.infisical.com on port 443
 - **No inbound rules required** - SSH reverse tunnels are outbound only
 
@@ -146,7 +147,7 @@ This design maintains security by avoiding the need for inbound firewall rules t
 <Accordion title="What if my firewall blocks SSH connections?">
 If your firewall has strict outbound restrictions:
 
-1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers
+1. **Work with your network team** to allow outbound TCP connections on port 2222 to relay servers (IP addresses or hostnames)
 2. **Allow standard SSH traffic** - most enterprises already have SSH policies in place
 3. **Consider network policy exceptions** for the gateway host if needed
 4. **Monitor firewall logs** to identify which specific rules are blocking traffic