GitHub
Meet WireRiftA small binary. A direct connection. Your infrastructure.InstallationNative binaries for your machine. No runtime to manage.Run your own serverThe public edge belongs to you.HTTP & WebSocket tunnelsShare web apps, receive webhooks, and keep WebSockets connected.TCP tunnelsA path for the protocols beyond HTTP.Security & accessLayer access controls around what you share.Traffic inspectorSee the request. Understand the response. Try it again.Under the wireOne connection. Many independent streams.Dashboard APIYour tunnels and traffic, programmatically.ConfigurationKeep your connections together in a readable config file.Docker deploymentGive your public edge a reproducible home.Local HTTPS developmentA trusted development edge, without a public domain.TroubleshootingGet back to a working connection.
Documentation, without the detour.ESC to close
Browse documentation
DOCUMENTATION / START HERE

Run your own server

The public edge belongs to you.

Start the server

Run the server on a machine reachable by your clients. Choose a strong token and keep it private. The domain must resolve to that machine.

terminal
wirerift-server \
  --domain tunnel.example.com \
  --token YOUR_TOKEN

The server defaults to control port 4443, HTTP port 80, HTTPS port 443 and a loopback dashboard on port 4040. Binding 80/443 may require OS permissions or a reverse proxy.

Point DNS at the edge

Create A records for your base domain and wildcard subdomain pointing at the server IP. Keep the marketing website and your tunnel server on separate domains or subdomains when they run on different infrastructure.

terminal
tunnel.example.com    A    YOUR_SERVER_IP
*.tunnel.example.com  A    YOUR_SERVER_IP

Configure HTTPS

For public certificates, set an ACME email and make the required HTTP challenge port reachable. The --auto-cert option generates self-signed certificates; it does not issue a publicly trusted certificate.

terminal
wirerift-server --domain tunnel.example.com \
  --token YOUR_TOKEN --acme-email you@example.com

Public edge HTTPS and control-plane TLS are separate settings. Configure --control-tls-cert and --control-tls-key to encrypt the client/server control connection.

Keep the dashboard private

The dashboard binds to 127.0.0.1 by default. Use an SSH forward to reach it from your workstation instead of exposing an administration port publicly.

terminal
ssh -L 4040:127.0.0.1:4040 user@YOUR_SERVER_IP
# Open http://localhost:4040 and authenticate with your token

Based on the upstream WireRift reference . Check the source for the latest options.

PreviousInstallationUp nextHTTP & WebSocket tunnels