service-add

Expose a service to the network without creating a VPN

Aliases: sa

Expose a local or a remote endpoint connection as a service in the VPN. The host will act as a proxy between the service and the connection

edgevpn service-add [options]

Flags

Flag Default Environment Description
--config — EDGEVPNCONFIG Specify a path to a edgevpn config file
--listen-maddrs — EDGEVPNLISTENMADDRS Override default 0.0.0.0 listen multiaddresses
--dht-announce-maddrs — EDGEVPNDHTANNOUNCEMADDRS Override listen-maddrs on DHT announce
--timeout "15s" EDGEVPNTIMEOUT Specify a default timeout for connection stream
--mtu 1200 EDGEVPNMTU Specify a mtu
--bootstrap-iface true EDGEVPNBOOTSTRAPIFACE Setup interface on startup (need privileges)
--packet-mtu 1420 EDGEVPNPACKETMTU Specify a mtu
--channel-buffer-size 0 EDGEVPNCHANNELBUFFERSIZE Specify a channel buffer size
--discovery-interval 720 EDGEVPNDHTINTERVAL DHT discovery interval time
--ledger-announce-interval 10 EDGEVPNLEDGERINTERVAL Ledger announce interval time
--autorelay-discovery-interval "5m" EDGEVPNAUTORELAYDISCOVERYINTERVAL Autorelay discovery interval
--autorelay-static-only false EDGEVPNAUTORELAYSTATICONLY Use only defined static relays
--ledger-synchronization-interval 10 EDGEVPNLEDGERSYNCINTERVAL Ledger synchronization interval time
--nat-ratelimit-global 10 EDGEVPNNATRATELIMITGLOBAL Rate limit global requests
--nat-ratelimit-peer 10 EDGEVPNNATRATELIMITPEER Rate limit perr requests
--nat-ratelimit-interval 60 EDGEVPNNATRATELIMITINTERVAL Rate limit interval
--nat-ratelimit true EDGEVPNNATRATELIMIT Changes the default rate limiting configured in helping other peers determine their reachability status
--max-connections 0 EDGEVPNMAXCONNS Max connections
--ledger-state — EDGEVPNLEDGERSTATE Specify a ledger state directory
--mdns true EDGEVPNMDNS Enable mDNS for peer discovery
--autorelay true EDGEVPNAUTORELAY Automatically act as a relay if the node can accept inbound connections
--concurrency 20 — Number of concurrent requests to serve
--holepunch true EDGEVPNHOLEPUNCH Automatically try holepunching when possible
--natservice true EDGEVPNNATSERVICE Tries to determine reachability status of nodes
--natmap true EDGEVPNNATMAP Tries to open a port in the firewall via upnp
--dht true EDGEVPNDHT Enable DHT for peer discovery
--low-profile true EDGEVPNLOWPROFILE Enable low profile. Lowers connections usage
--aliveness-healthcheck-interval 120 HEALTHCHECKINTERVAL Healthcheck interval
--aliveness-healthcheck-scrub-interval 600 HEALTHCHECKSCRUBINTERVAL Healthcheck scrub interval
--aliveness-healthcheck-max-interval 900 HEALTHCHECKMAXINTERVAL Healthcheck max interval. Threshold after a node is determined offline
--log-level "info" EDGEVPNLOGLEVEL Specify loglevel
--libp2p-log-level "fatal" EDGEVPNLIBP2PLOGLEVEL Specify libp2p loglevel
--discovery-bootstrap-peers — EDGEVPNBOOTSTRAPPEERS List of discovery peers to use
--connection-high-water 0 EDGEVPN_CONNECTION_HIGH_WATER max number of connection allowed
--connection-low-water 0 EDGEVPN_CONNECTION_LOW_WATER low number of connection allowed
--autorelay-static-peer — EDGEVPNAUTORELAYPEERS List of autorelay static peers to use
--relay-service true EDGEVPN_RELAY_SERVICE Offer the circuit-v2 relay service to cluster peers (i.e. let other peers reserve a slot on this node and route relayed traffic through us). Disabling does NOT prevent this node from USING other relays as a client via AutoRelay — set this to false on resource-constrained nodes or nodes that should not act as relays.
--relay-service-network-only true EDGEVPN_RELAY_SERVICE_NETWORK_ONLY Restrict incoming relay reservations to peers observed in the local ledger’s alive bucket (cluster members). Strangers that found us via the public DHT or another relay discovery path are rejected. Requires the alive service to be running. During a short bootstrap window — before the alive bucket is first observed — every reservation is allowed so the node itself can finish joining the cluster. Default ON: secure by default; pass –relay-service-network-only=false to open the relay to all peers.
--relay-service-acl-refresh "30s" EDGEVPN_RELAY_SERVICE_ACL_REFRESH Cadence at which the NetworkOnly relay-service ACL re-snapshots the alive bucket (Go duration). Should be <= the alive-service announce interval so peer churn is reflected within a couple of ticks.
--relay-service-max-data 1073741824 EDGEVPN_RELAY_MAX_DATA Bytes (per direction) a relayed connection may carry before reset. Higher values let cluster peers carry larger relayed transfers (e.g. model files for distributed inference) at the cost of a larger memory footprint per relay client. Set lower for resource-constrained deployments.
--relay-service-max-duration "30m0s" EDGEVPN_RELAY_MAX_DURATION Maximum lifetime of a single relayed connection (Go duration). Higher values let cluster peers carry longer-running relayed transfers at the cost of holding circuits open. Set lower for resource-constrained deployments.
--relay-service-max-circuits 64 EDGEVPN_RELAY_MAX_CIRCUITS Maximum number of concurrent relay circuits per peer. Higher values let a single peer hold more simultaneous circuits through this node at the cost of a larger memory footprint; the number of peers that may relay through us is bounded separately by the reservation limits. Set lower for resource-constrained deployments.
--relay-service-reservation-ttl "1h0m0s" EDGEVPN_RELAY_RESERVATION_TTL Time-to-live of a relay reservation (Go duration). Higher values reduce reservation churn for stable cluster peers; lower values free relay slots faster.
--relay-service-buffer-size 65536 EDGEVPN_RELAY_BUFFER_SIZE Per-circuit relayed connection buffer size in bytes. Higher values improve throughput of large relayed transfers at the cost of memory per relay client. Set lower for resource-constrained deployments.
--blacklist — EDGEVPNBLACKLIST List of peers/cidr to gate
--token — EDGEVPNTOKEN Specify an edgevpn token in place of a config file
--limit-enable false LIMITENABLE Enable resource management
--limit-file — LIMITFILE Specify a resource limit config (json)
--limit-scope "system" LIMITSCOPE Specify a limit scope
--limit-config-streams 200 LIMITCONFIGSTREAMS Streams resource limit configuration
--limit-config-streams-inbound 30 LIMITCONFIGSTREAMSINBOUND Inbound streams resource limit configuration
--limit-config-streams-outbound 30 LIMITCONFIGSTREAMSOUTBOUND Outbound streams resource limit configuration
--limit-config-conn 200 LIMITCONFIGCONNS Connections resource limit configuration
--limit-config-conn-inbound 30 LIMITCONFIGCONNSINBOUND Inbound connections resource limit configuration
--limit-config-conn-outbound 30 LIMITCONFIGCONNSOUTBOUND Outbound connections resource limit configuration
--limit-config-fd 30 LIMITCONFIGFD Max fd resource limit configuration
--peerguard false PEERGUARD Enable peerguard. (Experimental)
--ownership "enforce" EDGEVPNOWNERSHIP Ledger ownership enforcement: enforce (sign + reject unauthorized writes, default), observe (sign + log violations) or off (legacy, opt-out). All nodes on a network must run the same mode/wire format, so flip the whole network together.
--ownership-ttl 0 EDGEVPNOWNERSHIPTTL Liveness window in seconds after which an inactive owner’s ledger entries may be reclaimed/reaped. 0 derives it from –aliveness-healthcheck-interval (4x, so 8 minutes on defaults), which keeps healthy nodes from expiring when the heartbeat is retuned.
--privkey-cache false EDGEVPNPRIVKEYCACHE Enable privkey caching. (Experimental)
--privkey-cache-dir "$HOME/.edgevpn" EDGEVPNPRIVKEYCACHEDIR Specify a directory used to store the generated privkey
--static-peertable — EDGEVPNSTATICPEERTABLE List of static peers to use (in ip:peerid format)
--whitelist — EDGEVPNWHITELIST List of peers in the whitelist
--peergate false PEERGATE Enable peergating. (Experimental)
--peergate-autoclean false PEERGATE_AUTOCLEAN Enable peergating autoclean. (Experimental)
--peergate-relaxed false PEERGATE_RELAXED Enable peergating relaxation. (Experimental)
--peergate-auth — PEERGATE_AUTH Peergate auth
--peergate-interval 120 EDGEVPNPEERGATEINTERVAL Peergater interval time
--name — — Unique name of the service to be server over the network.
--address — — Remote address that the service is running to. That can be a remote webserver, a local SSH server, etc. For example, ‘192.168.1.1:80’, or ‘127.0.0.1:22’.
Last modified August 4, 2026: Fix/proxy egress ownership (#1066) (cfb9c39)