Skip to content
routeup

Public server

The public server receives internet traffic for a public DNS suffix and forwards each request through an outbound tunnel to a local routeup agent.

It is self-hostable and included in the same routeup binary as the CLI and local agent.

What it handles

Section titled “What it handles”
  • Token-scoped public route claims.
  • Optional token-less public namespace.
  • SQLite persistence for tokens and token-backed route holds.
  • Reserved subdomain enforcement.
  • HTTPS termination.
  • WebSocket + yamux tunnel transport back to the local agent.

TLS

Section titled “TLS”

The server always serves HTTPS. In acme mode it obtains wildcard certificates through Let’s Encrypt using Cloudflare DNS-01 and CLOUDFLARE_API_TOKEN. In cert mode the operator provides a certificate and key.

Client usage

Section titled “Client usage”

The control host, such as edge.example.com, must resolve to the server and should be reserved from root-tier route claims.

terminal
routeup setup --server https://edge.example.com --token sk_routeup_xxx
routeup serve example-app --port 8080 --expose