Skip to content
routeup

Running the server

The public server is the same routeup binary you already have. Self-hosting means running it with your own domain, DNS, and TLS, the hosted routeup.dev is just one deployment of this code.

Prerequisites

Section titled “Prerequisites”
  • A domain (or subdomain) you control, e.g. tunnel.example.com.
  • DNS for the root wildcard and every enabled nested namespace pointing at the server. See DNS setup.
  • A way to issue TLS. By default that is a Cloudflare API token for ACME DNS-01. See TLS.

Start it

Section titled “Start it”
Terminal window
export CLOUDFLARE_API_TOKEN="your-cloudflare-api-token"
routeup server --domain tunnel.example.com \
  --reserved edge \
  --db /var/lib/routeup/server.db

This serves HTTPS for root-tier and configured namespace hosts, authenticates tunnel clients, and forwards public requests down their matching tunnels. edge.tunnel.example.com is the client control host in these examples; --reserved edge prevents a root-tier token from claiming that label.

Configure a client with the control host, not the suffix apex:

Terminal window
routeup setup --server https://edge.tunnel.example.com --token sk_routeup_xxx

Common flags:

--domain <suffix>           public suffix to serve
--config <path>             server config file
--db <path>                 SQLite database path
--public-namespace <label>  enable token-less claims under one label
--reserved <label>          reserve a root-tier label; repeatable
--tls-mode <acme|cert>      acme auto-issues wildcards; cert uses your files
--tls-cert <path>           PEM certificate for cert mode
--tls-key <path>            PEM private key for cert mode

Deployment shape

Section titled “Deployment shape”

A single small VM is enough for v1, the server is one binary with a local SQLite database. Put it behind a stable IP, open 443, and run it under a process supervisor (systemd, a container restart policy) so it comes back after reboots.

State and backups

Section titled “State and backups”

The server keeps tokens and token-backed route holds in SQLite. Public-namespace holds are session-only and are purged at startup. Back up the SQLite file so you do not have to re-mint and redistribute tokens after a host loss.

Operating

Section titled “Operating”
  • Mint and revoke access with tokens.
  • Reserved subdomains (api, admin, www, try, …) are refused for claims and can be extended in server config.
  • Logs are structured; tail them through your supervisor.