No IPs.
No Ports.
No Exposure.
This is the optional Gateway architecture. Activate it and every DYLARIS game server becomes invisible to the public internet — player traffic enters through disposable Edge nodes, files flow through Beam, the node itself never exposes a port. Without the Gateway, DYLARIS runs like any other host: public IPs, SFTP, port 25565.
Traffic Flow
Splice and Edge are two Docker containers on the same VPS. Splice is a sidecar that handles raw TCP: accepting connections, forwarding to Edge, managing session splice. Edge owns all application logic: eBPF/XDP filtering, L7 protocol parsing, route lookup, and Yamux toward Link.
Link agents run inside the hosting network and connect outbound to every known Edge simultaneously. No inbound ports, no firewall rules. Game server networks stay air-gapped from the internet.
Hub manages the routing table. It auto-discovers Edges and Links via Redis heartbeats, validates proof-of-knowledge tokens, and syncs routes to all Edges on a 24h TTL cycle.
Disposable Infrastructure Layer
DockerAn Edge node is any cheap VPS or bare-metal instance running two containers: Splice (raw TCP accept, forwarding, session splice) and Edge (eBPF/XDP, L7 parsing, Yamux, routing). Only the Edge node needs a public IP. Edge nodes are intentionally disposable. Swap the IP, redeploy, update DNS. No backend servers go down. No state is lost.
When Edge needs updating, Splice routes past the old Edge, connecting directly to Link and transparently redirects all active TCP streams to the new Edge container. The splice happens at the raw TCP level so players experience no disconnect, only a brief lag spike of under 50ms.
Public Ingress Router
5,313 LoC · GoDockerMain service on the Edge node VPS, running alongside the Splice sidecar container. Compiles and attaches its own eBPF/XDP program at startup.
Edge is the main Docker container on the VPS, paired with the Splice sidecar. It owns all application logic: eBPF/XDP packet filtering, L7 protocol parsing to identify the target server, route lookup, and Yamux multiplexing toward Link. The Splice container handles only raw TCP accept and forwarding. Edge does the rest.
Kernel-Level Firewall
216 LoC · CThe XDP program is a 216-line C file compiled to a BPF object at Edge container startup via bpf2go + clang. It attaches to the NIC in driver mode. Packets are inspected before they touch the kernel networking stack. No Docker networking overhead.
Zero-Port Tunnel Agent
1,444 LoC · GoDockerRuns as a Docker container (or systemd service) inside the hosting network. Zero inbound ports required.
Link is a small Go binary that ships as a single Docker container and runs inside your hosting network. It never opens any inbound ports. Instead, it dials out to all known Edges simultaneously, establishing persistent mTLS/Yamux sessions. Player traffic flows back through these sessions in reverse. When an Edge is replaced, Link automatically session-splices to the new one.
| Redis | Subscribes to Edge list from shared Redis. New Edge nodes auto-discovered as soon as Edge registers. |
| Static | Hardcoded Edge address list. Used in air-gapped setups where Redis isn't shared. |
| Push | Edge sends a connect request to Link via Redis pubsub. Link dials back within 200ms. |
Control Plane
1,752 LoC · GoDockerHub is the cluster state manager. It ships as a Docker container alongside PostgreSQL and Redis. It knows every Edge, every Link, every route. It uses Redis heartbeats to auto-discover infrastructure without manual registration. Routes are stored in PostgreSQL (via GORM) with per-tenant table namespacing and pushed to all Edges on a 24-hour TTL sync cycle, including newly deployed Edge nodes.
Redis Auto-Discovery
Edges and Links publish heartbeats to Redis. Hub reads these, validates proof-of-knowledge tokens, and registers them (including freshly deployed Edge containers) without any manual API call.
Proof-Based Auth
No raw secrets in Redis. Each node publishes H(secret || nonce). Hub verifies locally. A replay attack from Redis gives an attacker nothing usable.
Multi-Tenant Namespacing
All Hub tables use a configurable prefix (dylaris_hub_*). Multiple Hub instances share one PostgreSQL cluster without schema conflicts.
Route Sync · 24h TTL
Hub re-validates all routes every 24h. Stale routes are purged from all Edge routing tables, including after rolling updates replace old containers.
File Infrastructure Relay
1,166 LoC · Go + WailsDockerBeam eliminates FTP/SFTP entirely. The Beam Relay runs as a Docker container in the hosting network. It handles token authentication and connection routing. The desktop client (Wails/Go) connects to the relay and streams files directly to Node containers via Yamux-multiplexed gRPC over TLS. No legacy file transfer protocols, no exposed ports.
Beam Relay
~900 LoCCOMPLETEAccepts Beam client connections, validates short-lived tokens from Redis (beam:token:{uuid}), and proxies streams to the correct Node Docker container. Yamux multiplexing. One TLS connection supports concurrent file operations.
Desktop Client (Wails)
~266 LoCIN PROGRESSNative desktop app (Go + WebView2) that ships as a standalone installer. File browser UI complete and REST-based. Tunnel-based streaming architecture implemented in Relay and ready. Client-side integration in progress.
vs. Conventional Hosting Infrastructure
Every other approach exposes server IPs to the public internet. DYLARIS doesn't.
| Approach | Zero Exposed IPs | Kernel DDoS | MC Protocol | Rolling Updates | Full Panel | Docker-Native |
|---|---|---|---|---|---|---|
| DYLARIS | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Traditional Panel Hosting Each server needs its own IP. One DDoS → server offline. | ✗ | ✗ | ✗ | ✗ | ~ | ~ |
| BungeeCord / Velocity MC proxy only. Still exposes the proxy IP. No DDoS layer. | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ |
| Cloudflare Tunnel TCP tunneling only. No Minecraft protocol parsing, no eBPF, no panel. | ✓ | ✗ | ✗ | ✗ | ~ | ✗ |
| Pterodactyl / Pelican Panel + Docker orchestration, but servers still fully exposed. | ✗ | ✗ | ✗ | ✗ | ✓ | ✓ |
| Ngrok / frp General TCP tunneling. No DDoS, no protocol awareness, no panel. | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
The Only Portless Stack
DYLARIS is the only game hosting platform where backend servers have zero public-internet presence. No IP to expose. No port to DDoS. Link connects outbound only.
Protocol-Aware at the Edge
Edge understands Minecraft VarInt handshakes, TLS SNI, and HTTP Host headers natively. Run 1,000 servers on a single IP and port. No SRV records, no proxy fleet.
Kernel Drops, Not Null Routes
eBPF/XDP filters run before the kernel networking stack. ~50ns drop latency. Not scrubbing centers, not rate-limiting in nginx. Packets die at the NIC driver.
Component Overview
| Component | Role | Protocol | Open Ports | Docker | LoC |
|---|---|---|---|---|---|
Edge Node | Disposable VPS · hosts Edge + Splice containers | n/a | 25565, 443, 80 | VPS | n/a |
Edge | Public ingress, L7 routing, eBPF/XDP | Minecraft · TLS/SNI · HTTP · Yamux | 25565, 443, 80 | image | 5,313 |
Splice | TCP accept sidecar, rolling-update bypass | raw TCP | (via Edge node) | sidecar | ~600 |
Link | Outbound tunnel agent, session splice | mTLS + Yamux (outbound only) | none | image | 1,444 |
Hub | Control plane, route registry | gRPC + REST | internal | image | 1,752 |
Beam Relay | File transfer relay, token auth | Yamux over TLS | 9090 (internal) | image | ~900 |
eBPF/XDP | Kernel-level packet filter | XDP_DROP / XDP_PASS | NIC hook | compiled in Edge | 216 C |
Built to host at scale.
Edge · Splice · Link · Hub · Beam. A complete, Docker-native hosting infrastructure stack. Currently in active development.