# Operator commands

> Server-side commands for running a routeup deployment and minting tokens.

These commands run the public server and manage its tokens. They are hidden from
the default `routeup --help` because normal users never need them. Everything
here is for the operator of a deployment, see [Self-hosting](/docs/self-hosting/running-the-server)
for the full guide.

## Run the server

```bash
CLOUDFLARE_API_TOKEN=… \
  routeup server --domain tunnel.example.com --reserved edge \
  --db /var/lib/routeup/server.db
```

Key flags:

```txt
--domain <suffix>           public suffix, e.g. tunnel.example.com
--config <path>             server config file
--db <path>                 SQLite database path
--public-namespace <label>  enable a token-less namespace
--reserved <label>          reserve a root-tier label; repeatable
--tls-mode <acme|cert>      acme auto-issues wildcards; cert uses your files
--tls-cert <path>           PEM certificate for cert mode
--tls-key <path>            PEM private key for cert mode
```

Run `routeup server --help` for listen, ACME, logging, metrics, and rate-limit
options.

In `acme` mode the server obtains and renews wildcard certificates through Let's
Encrypt using the Cloudflare DNS-01 challenge (`CLOUDFLARE_API_TOKEN`). In `cert`
mode you provide a certificate and key. See [TLS](/docs/self-hosting/tls).

## Manage tokens

Tokens authorize persistent, scoped public claims. Mint them out-of-band and hand
the secret to the client privately.

```bash
routeup token create mukul --allow "*.tunnel.example.com" --db /var/lib/routeup/server.db
routeup token create alice --allow "*.alice.tunnel.example.com" --db /var/lib/routeup/server.db
routeup token list --db /var/lib/routeup/server.db
routeup token revoke <token-id> --db /var/lib/routeup/server.db
```

Run token commands on the server host. They open SQLite directly, so use the same
`--db` or `--config` value as the running server.

The allow pattern is the only authority; the server rejects any claim whose host
falls outside it. Tiers fall out of the pattern shape:

```txt
*.tunnel.example.com          # root tier; one label under the suffix
*.alice.tunnel.example.com    # a personal namespace
*.team-x.tunnel.example.com   # a shared team namespace
```

Token secrets use the `sk_routeup_` prefix, are shown once at creation, and are
stored only as a SHA-256 hash. See [Minting tokens](/docs/self-hosting/minting-tokens).