Everything on the other pages runs on your own machines and needs nothing from us. This page is about the one part that does not.

What it does

The edge gives a Minecraft server a clean address:

Players connect to your domain on :25565. No port in the address, no SRV record.
Your machine needs no open ports and no public IP. It dials outward, so it works behind CGNAT, DS-Lite, Starlink and mobile internet too.
Your real address is never visible to a player, so it cannot be attacked directly.
The edge reads the Minecraft handshake of every connection first. Garbage, malformed packets, stalled connections and joins for addresses that do not exist are dropped there. Each IP may open at most 10 new connections a second, and one that opens more than 100 in 15 seconds is blocked for a minute. A player refreshing the server list stays far below both.
Large volumetric attacks are filtered before that, by the network-level DDoS protection of the data centres the edges run in.

Setup on your side is nothing for one of our subdomains, or a CNAME plus a TXT verification record for your own domain.

What it is not

The edge is not a Velocity or BungeeCord replacement. It is a handshake-aware tunnel in front of your server, not a server-network proxy: it does not log players in, does not switch them between servers and never touches the game session. Login and encryption stay between the player and your server, so it works with Vanilla, Paper, Fabric, Forge and NeoForge alike. Already run Velocity or BungeeCord? Keep it and put the edge in front of it.

It also does not carry UDP, so Bedrock, Geyser and voice chat plugins do not work through it, and your server sees every player arrive from one address rather than their own. See Known limits.

Two ways to have one

Managed by us. You take one of our subdomains or point your own domain at us, and we run the edges, the hub and the tunnels. Nothing to install, nothing to patch. This is what the store sells.

Run your own. The same system can run on your infrastructure - your regions, your addresses, your traffic. That is not a self-service download: it needs a conversation and an arrangement that works for both sides, so it is open to networks, hosts and communities who actually want to operate edges rather than rent them. If that is you, ask us.

It runs on its own, too. The gateway's hub carries its own admin interface and manages its own DNS: you give it a provider credential and the zones it may write into, and it keeps the regional edge wildcards and the beam relay address pointed at whatever is actually online, removing an address only after a grace period so a rolling restart never takes a region out of DNS. Thirteen providers work through libdns.

The same credential also gets the beam relay its TLS certificate: switch Certificates on and the hub obtains one over the DNS-01 challenge, renews it, and delivers it to every relay without a restart. One you mount yourself still wins. No platform is required for any of it - and with one, the whole thing is configured from the panel instead, so the hub's own interface stays off.

Where it is right now

Straight, because you should not find this out after committing:

The edge is closed source. It is not in the public repository and there is no build you can pick up and run.

DYLARIS is a hosted service: the platform software is public on GitHub, we run the gateway, and a self-serve offering is not planned. What the edge cannot do yet is listed on Known limits.

What happens without it

Dylaris runs standalone. Routing mode ip_port means the node binds a host port and players connect to your-ip:port. Every other feature behaves identically - the panel, modpacks, files, users, scheduling, profiling, the API.

What you give up is precisely three things: the tidy address, the hidden origin, and the filtering in front of your server.

How it fits together

Three pieces, and you only ever see the first:

Edge - the regional entry point players connect to.
Hub - decides which server a connection belongs to.
Tunnel - the encrypted link from the edge to your machine. This is what removes the need for port forwarding.

Your node needs nothing reachable from the internet. It opens the tunnel itself, outbound, and traffic comes back down it.

Two ways to use it

Bring your own node - your hardware, our control plane and address, full panel.
Route only - you keep running your server exactly as it is and only take the protected address.

The machine can be anywhere, including your house

The tunnel is what makes that true. For your own node, Warp pulls the machine into the fleet over WireGuard, outbound only, so it needs no public IP, no port forwarding and no static address. A gaming PC behind a home router joins the same way a rented server does, and can leave and come back on a different network without anything being reconfigured.

That matters if the machine is not in a datacentre:

Streamers and creators. Run the server on hardware you already own, in your own room, and hand your community an address that leads nowhere near your home connection. Nobody watching gets your IP, and neither does anyone who decides to attack the server after a bad round.
Communities with a donated box. Someone's spare machine becomes a real node without them opening anything on their router.
Machines that move. A node that changes network keeps working; it dials out again and re-registers.

An external node is a normal node in every other way: same panel, same servers, same backups.

The managed edge