The managed edge

Everything on the other pages runs on your own machines and needs nothing from us. This page is about the one part that does not.

What it does

The edge gives a Minecraft server a clean address:

• Players connect to your domain on :25565. No port in the address, no SRV record.
• Your machine needs no open ports and no public IP. It dials outward.
• Your real address is never visible to a player, so it cannot be attacked directly.
• Attack traffic is absorbed before it reaches you.

Setup on your side is a single CNAME.

Two ways to have one

Managed by us. You point a CNAME at an address the panel gives you and we run the edges, the hub and the tunnels. Nothing to install, nothing to patch. This is what the store sells.

Run your own. The same system can run on your infrastructure - your regions, your addresses, your traffic. That is not a self-service download: it needs a conversation and an arrangement that works for both sides, so it is open to networks, hosts and communities who actually want to operate edges rather than rent them. If that is you, ask us.

It runs on its own, too. The gateway's hub carries its own admin interface and manages its own DNS: you give it a provider credential and the zones it may write into, and it keeps the regional edge wildcards and the beam relay address pointed at whatever is actually online, removing an address only after a grace period so a rolling restart never takes a region out of DNS. Thirteen providers work through libdns.

The same credential also gets the beam relay its TLS certificate: switch Certificates on and the hub obtains one over the DNS-01 challenge, renews it, and delivers it to every relay without a restart. One you mount yourself still wins. No platform is required for any of it - and with one, the whole thing is configured from the panel instead, so the hub's own interface stays off.

Where it is right now

Straight, because you should not find this out after committing:

The edge is closed source and in testing. It is not in the public repository and there is no build you can pick up and run today.

We have not decided what it becomes. The candidates are a paid managed service, a licence for people who want to run their own edges, and support arrangements for larger deployments - possibly all three. If you are planning something that depends on knowing, ask us. We would rather have that conversation than have you guess from a marketing page.

What happens without it

Dylaris runs standalone. Routing mode ip_port means the node binds a host port and players connect to your-ip:port. Every other feature behaves identically - the panel, modpacks, files, users, scheduling, profiling, the API.

What you give up is precisely three things: the tidy address, the hidden origin, and the attack absorption.

How it fits together

Three pieces, and you only ever see the first:

• Edge - the regional entry point players connect to.
• Hub - decides which server a connection belongs to.
• Tunnel - the encrypted link from the edge to your machine. This is what removes the need for port forwarding.

Your node never accepts an inbound connection from the internet. It opens the tunnel itself, outbound, and traffic comes back down it.

Two ways to use it

• Bring your own node - your hardware, our control plane and address, full panel.
• Route only - you keep running your server exactly as it is and only take the protected address.

The machine can be anywhere, including your house

The tunnel is what makes that true. Warp pulls a machine into the fleet over WireGuard, outbound only, so it needs no public IP, no port forwarding and no static address. A gaming PC behind a home router joins the same way a rented server does, and can leave and come back on a different network without anything being reconfigured.

That matters if the machine is not in a datacentre:

• Streamers and creators. Run the server on hardware you already own, in your own room, and hand your community an address that leads nowhere near your home connection. Nobody watching gets your IP, and neither does anyone who decides to attack the server after a bad round.
• Communities with a donated box. Someone's spare machine becomes a real node without them opening anything on their router.
• Machines that move. A node that changes network keeps working; it dials out again and re-registers.

An external node is a normal node in every other way: same panel, same servers, same backups.