Drip LogoDrip

Direct Mode (Recommended)

Drip server handles TLS directly on port 443.

Overview

In direct mode, Drip handles TLS termination itself. This is the simplest setup and recommended for most users.

Step 1: Get SSL Certificate

bash
sudo certbot certonly --manual --preferred-challenges dns \
  -d "*.tunnel.example.com" -d "tunnel.example.com"

Certificates are saved to:

  • Certificate: /etc/letsencrypt/live/tunnel.example.com/fullchain.pem
  • Private key: /etc/letsencrypt/live/tunnel.example.com/privkey.pem

Step 2: Start Server

bash
drip-server \
  --port 443 \
  --domain tunnel.example.com \
  --tls-cert /etc/letsencrypt/live/tunnel.example.com/fullchain.pem \
  --tls-key /etc/letsencrypt/live/tunnel.example.com/privkey.pem \
  --token YOUR_SECRET_TOKEN

Server Flags

FlagDescriptionDefault
-p, --portServer listening port8443
--public-portPort shown in URLs (for reverse proxy)same as --port
-d, --domainServer domaintunnel.localhost
-t, --tokenAuthentication token(required)
--tls-certPath to TLS certificate(required)
--tls-keyPath to TLS private key(required)
--tcp-port-minMinimum TCP tunnel port20000
--tcp-port-maxMaximum TCP tunnel port20100
--metrics-tokenToken for /metrics and /stats endpoints(optional)
--debugEnable debug loggingfalse
--pprofEnable pprof profiling on specified port(disabled)

Environment Variables

All flags can be set via environment variables:

VariableDescription
DRIP_PORTServer port
DRIP_PUBLIC_PORTPublic port for URLs
DRIP_DOMAINServer domain
DRIP_TOKENAuthentication token
DRIP_TLS_CERTTLS certificate path
DRIP_TLS_KEYTLS private key path
DRIP_TCP_PORT_MINMin TCP port
DRIP_TCP_PORT_MAXMax TCP port
DRIP_METRICS_TOKENMetrics endpoint token
DRIP_PPROF_PORTPprof profiling port

Server Endpoints

EndpointPurposeAuth Required
/healthHealth check (returns 200 OK)No
/statsServer statistics (JSON)Yes (metrics-token)
/metricsPrometheus metricsYes (metrics-token)

Rate Limiting

The server enforces rate limits to prevent abuse:

  • 10 tunnel registrations per IP per minute
  • 10 tunnels maximum per IP
  • 1000 tunnels maximum total

TLS Configuration

Drip uses TLS 1.3 exclusively with modern cipher suites:

  • TLS_AES_128_GCM_SHA256
  • TLS_AES_256_GCM_SHA384
  • TLS_CHACHA20_POLY1305_SHA256

Legacy TLS versions (1.0, 1.1, 1.2) are not supported.

PrerequisitesBehind Caddy