You already run a Minecraft server and you are happy with it. You do not want to migrate, adopt a panel, or change how anything works. You just want a protected address in front of it.

That is this.

Before you start

Your store account and your panel account have to be joined first, or the link you are about to create has no allowance behind it. See Connecting your account.

Setup, in about ten minutes

You run one small container, the link, next to your server, plus watchtower, which keeps it updated. That is the whole install.

In the panel, create a link under Protected Addresses. You get its key once, on screen, already filled into the compose file shown beside it.
Save that file and start it:
shell
```
docker compose -f route-only.yml up -d
```
The link opens outbound tunnels to our edges and dials your server on its local address. It talks to us over HTTPS with its key and nothing else.

It publishes no ports at all and needs no extra privileges. Every connection is made outward, from your machine.
Create a route, pointing it at your server as host:port - the address the link sees locally, so 127.0.0.1:25565 or a LAN address is normal here. If the server is not on the same machine as the link, its host has to be listed in LINK_ALLOWED_TARGETS.
Take the subdomain we give you, or point your own domain at us with a CNAME plus a TXT record at _dylaris-verify.<your-domain>, both shown in the panel, within 4 hours.

Players connect to that domain on :25565. Nothing else changes: your server, its world, its plugins and how you administer it all stay exactly as they are.

What you did not have to do: no SRV record, no port forwarding, no router config, no static IP, no firewall hole. There is nothing inbound to allow, because nothing comes inbound.

Requirements: Docker, outbound HTTPS and outbound TCP to the edges. The link uses host networking so it reaches your server exactly where you say it is. The panel's file has a Docker Desktop variant; Linux is what we test on.

Updates: watchtower updates the link nightly at 04:00, in the time zone set in your kit (TZ). When a new version is pulled, players are briefly disconnected once.

No VPN into your network

The link is not a VPN. It holds one key, which can do three things: fetch the edge list, say the link is alive, and report its connection counters. It gives nobody a way into your machine or your LAN, and it holds no login to anything of ours. Revoke the key in the panel and the link is cut off within half a minute.

Your home address stays yours

For a home server behind NAT this is the point of the whole thing. Players resolve a domain that leads to our edge, the edge reaches your machine down a tunnel your machine opened, and at no stage does anyone on the other end learn your connection's address. There is no public address to find, because you never published one.

If your server has a public IP, close it

If the machine is a VPS or a dedicated box reachable directly, the tunnel alone is not enough: the old address still answers. Close that port to the internet entirely - bind the server to 127.0.0.1 or your LAN, or drop it in the firewall. Players never connect to it directly: the link reaches it from the same machine or network, and the edges only ever talk to the link.

Skip that and the protection is decorative. Someone who finds the real address connects to it and walks straight past everything you just set up. A tidy domain does not hide a host that still picks up the phone.

What your server sees

Every player reaches your server from one address, the link's - usually 127.0.0.1 - because PROXY protocol is not supported yet. IP bans, /ban-ip, anti-bot or anti-VPN plugins and per-IP limits cannot tell players apart. See Known limits.

What you do not get

Route-only is deliberately narrow. You keep your setup, so you keep its limits:

No panel management of that server - it is not a Dylaris server
No in-panel console, files, backups or scheduling for it
No modpack builder for it

If you want those, that is Bring your own node, which keeps the same hardware and adds the panel on top.

When route-only is the right answer

A community server with a working setup you do not want to touch
A server someone else administers
Trying the protected address before committing to anything

Route only