Skip to content
Documentation

Bring your own node

Your hardware, our control plane. A home PC, a NAS, a spare box or a VPS becomes a managed node without any of the networking work.

What you need

  • A Linux x86_64 machine with Docker, or Windows through Docker Desktop with WSL2. The images are amd64 only, so ARM boards such as a Raspberry Pi do not work, and macOS is not offered.
  • A kernel with WireGuard
  • Outbound UDP for the tunnel (port 25599 by default) and outbound HTTPS

That is the list. No static IP, no port forwarding, no router configuration, no dynamic DNS.

Before you start

Your store account and your panel account have to be joined, or nothing you buy raises a limit. See Connecting your account; it takes about thirty seconds and you do it once.

How it works

  1. In the panel, add a node. You get a deploy snippet - a small compose file with the values for this one machine already filled in.
  2. Run it on your machine with docker compose up -d. It starts warp (the WireGuard client), node and link, plus watchtower, which keeps the other three updated.
  3. The node opens an encrypted tunnel outward, proves who it is, and appears in the panel.
  4. Create servers on it like any other node.

You never forward a port or open a firewall hole: every connection the kit needs, it opens outward, and nothing needs to be reachable from the internet. The node is host-networked and binds 25520-25523 on the machine itself - 25520 (SFTP), 25521 and 25523 (Beam), 25522 (server moves) - and each one asks for a credential Dylaris issues. On a machine with a public IP, firewall 25520-25523 anyway; Beam's direct path only needs them reachable from your own network.

What your machine is given, and what it is not

This matters if you are the sort of person who reads before running someone else's compose file.

The kit itself needs real access to the machine: it mounts the Docker socket, warp runs with NET_ADMIN and the node with SYS_ADMIN.

Your node receives a single-use enrolment token and a certificate fingerprint. It does not receive, and never holds:

  • the cluster secret
  • the panel's signing key
  • the database password
  • any credential belonging to another node

Its identity is assigned by the server and is not your hostname, so it cannot be guessed. Every reconnect proves possession of a per-node secret without sending it. Its access to the coordination bus is scoped to its own keys: a node cannot read or write anything belonging to a neighbour.

If the machine is lost, its credentials are worth nothing anywhere else.

Joining is gated before authentication

Admission is checked before any credential is looked at: an address allowlist and a join toggle. A machine that is not supposed to join is turned away before the question of whether it has a valid token even arises.

The join window can be one-shot, so it consumes itself after a single successful enrolment and closes behind you.

Files

Nodes that join this way use Beam and cannot fall back to SFTP - the panel does not hand out an SFTP address for them. If your desktop is on the same network as the node, Beam finds the direct path and transfers run at local speed.

Suspension

If a payment fails you have 5 days to settle it, then the account is suspended, and 48 hours later servers stop and the tunnel is cut, not just the panel login. World files on your machine are untouched, and the node reconnects on its own once the account is active again. Backups in our storage are deleted 3 weeks after the suspension; backups in your own S3 bucket are never deleted.

What your server sees

Every player reaches your server from one address, the link's, because PROXY protocol is not supported yet. IP bans and anti-bot or anti-VPN plugins cannot tell players apart. See Known limits.

Cost

You supply the compute, which is the expensive part, so this is cheaper than renting a server from anyone. You pay for the address and the traffic that runs through it.

Each node includes 50 GB of backup storage in our object storage. More is opt-in in the panel at EUR 1.50 per started 50 GB block, up to 500 GB more. Traffic beyond your allowance plus a 10% fair-use buffer is opt-in at EUR 2.00 per started TB. Current prices are on the pricing page.