| Role | Exposure | Responsibility |
|---|---|---|
| Agent | Internet-facing client | Connects to one configured relay endpoint at a time. |
| Relay | Internet-facing | Accepts agent MQTT/TLS connections and bridges permitted traffic onward. |
| Private overlay | Non-public | Authenticates and encrypts relay-to-broker connectivity. |
| Broker | Private only | Provides the single MQTT service consumed by the Mythic MQTT profile. |
| Mythic operator environment | Private only | Runs Mythic and reaches the broker through the approved private path. |
- An agent selects its primary configured relay endpoint.
- The relay terminates or passes through the agent-facing MQTT/TLS connection, according to the deployment's broker design.
- The relay bridge forwards allowed MQTT traffic across a private overlay to the broker.
- Mythic's MQTT C2 profile connects to that private broker.
- If an agent cannot reach its selected relay, it tries another configured relay endpoint according to the agent's own retry/failover behavior.
The broker is not a public fallback target. Relays are the publicly reachable ingress layer; the broker remains private.
Keep these concerns independent:
- Mythic MQTT profile: listener lifecycle and broker connection.
- Agent: endpoint ordering, reconnect behavior, and any agent-side failover.
- Relay: public ingress and bridge connectivity.
- Private network: authorization between relays, broker, and operators.
This separation makes relay rotation possible without changing the Mythic listener itself.
Multiple relays reduce dependence on one public ingress point, but they do not make the private broker highly available. A production design that needs broker availability should define and test a separate broker recovery strategy. Do not describe multiple relays as broker failover unless the broker layer itself has been designed and tested for that property.