{"eid":"github-maceip","name":"Freehold","domain":"github.com","resolved_by":"platform","topics":["egress"],"n_records":1,"best_vorder":5,"review":null,"aliases":["Freehold","github.com"],"records":[{"rid":"egress/freehold","card":{"rid":"egress/freehold","eid":"github-maceip","topic":"egress","slug":"freehold","provider":"Freehold","url":"https://github.com/maceip/freehold","domain":"github.com","category":"public anycast relay (QUIC/H3)","tier":"free","verdict":"fails-egress","vorder":5,"grp":"rejected","confidence":"inferred","binding":"none","identity_kind":"anonymous","identity_basis":"stated","needs_card":0,"needs_phone":0,"needs_id":0,"needs_institution":0,"country":null,"crypto":null,"interfaces":"cli","egress_metered":0,"per_object_bytes":null,"retention_days":null,"verified_at":"2026-10-23T00:00:00.000Z","verified_basis":"live","checked_on":"2026-10-23","stale_on":"2026-11-22","n_evidence":3,"usd_month":null,"usd_per_tb_month":null,"summary":"Your service is now reachable at freehold.lit.app:8080.","duplicate_of":null,"n_unknown":2},"record":{"topic":"egress","slug":"freehold","provider":"Freehold","url":"https://github.com/maceip/freehold","category":"public anycast relay (QUIC/H3)","tier":"free","free_tier":{"stated":"Your service is now reachable at freehold.lit.app:8080.","unit":"none","metered_on":"unstated","source_url":"https://github.com/maceip/freehold","read_on":"2026-10-23","notes":""},"per_object_cap":{"stated":"not applicable","bytes":null,"source_url":"https://github.com/maceip/freehold","notes":""},"retention":{"stated":"not applicable","days":null,"source_url":"https://github.com/maceip/freehold","notes":""},"egress":{"terms":"No byte allowance is published for the public relay: 'Test the public relay without installing anything.'; ingress: http-only","metered":false,"free_allowance":"none published","price_per_tb":null,"source_url":"https://github.com/maceip/freehold"},"interface":["cli"],"interface_detail":"'freehold --relay freehold.lit.app:9999 --port 8080 --backend 127.0.0.1:3000'","tooling":"The freehold Rust client; the relay itself needs a Linux host with eBPF and root, which is the operator's problem and not the client's","chaining":"Nothing to chain until the datagram question is settled.","limits":[{"kind":"volume-quota","value":"no byte allowance published for the public relay","source":"https://github.com/maceip/freehold"}],"limits_note":"","binding":"none","binding_note":"The relay is a public anycast endpoint with no published quota; what stops the UDP test first is the data path, which is described as QUIC/H3 rather than a raw datagram forward.","identity_cost":{"kind":"anonymous","detail":"No account: the client registers itself with the relay over UDP and completes an HMAC challenge.","country":"None"},"reliability_note":"NAT traversal is best-effort: the port spray 'opens Bob's NAT' only if the carrier allocates ports sequentially, and traffic falls back to the relay otherwise.","confidence":"inferred","confidence_note":"This is a reading of the architecture diagram and the feature list, not a test. Sending a non-QUIC UDP service to freehold.lit.app and watching for the datagram at the origin would settle it in one run.","evidence":[{"url":"https://github.com/maceip/freehold","date":"2026-10-23","proved":"'Give any device a real public IP address. Host services that browsers trust - not tunnel URLs.'"},{"url":"https://github.com/maceip/freehold","date":"2026-10-23","proved":"'This relay announces the 142.248.222.0/24 anycast prefix.' and 'A public relay is available at freehold.lit.app:9999'"},{"url":"https://github.com/maceip/freehold","date":"2026-10-23","proved":"The data path is 'Browser (Alice) ... QUIC/H3 request ... XDP SNAT+DNAT', and the feature list names 'Optional HTTP/3 reverse proxy with automatic TLS'"}],"verdict":"fails-egress","verified_at":"2026-10-23T00:00:00.000Z","price_per_tb_month":"USD 0","notes":"A free public anycast relay that a client can register with anonymously is the exact shape wanted, and it is the only such relay found. What it exposes is an HTTP/3 service on a shared anycast name: the README diagram shows a QUIC request being rewritten, not a raw datagram being forwarded, and the client is a Rust binary, not a tunnel daemon. If that reading is wrong, this becomes the strongest lead, which is why it is labelled inferred rather than refuted.","extras":{"wg_path":"none","wg_detail":"No WireGuard; the relay terminates QUIC and rewrites addresses with XDP.","ingress":"http-only","volume_tib_month":null,"volume_stated":"No byte allowance is published for the public relay: 'Test the public relay without installing anything.'","bytes_transit":"yes","transit_note":"The relay's XDP program forwards to the registered client, or the client and peer go direct after a successful punch."}},"claims":[{"path":"$.free_tier.stated","kind":"free-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.limits[0].value","kind":"limit:volume-quota","num":null,"unit":null,"per":null,"currency":null,"usd":null,"fx_date":null,"parse":"unparsed"},{"path":"$.price_per_tb_month","kind":"price-per-tb","num":0.0,"unit":"TB","per":"month","currency":"USD","usd":0.0,"fx_date":null,"parse":"ok"}],"unknown":[["$.per_object_cap.stated","not-applicable"],["$.retention.stated","not-applicable"]],"history":[],"drift":[]}]}