Skip to content
xPort

Gateway

The gateway terminates TLS for your public edge domain (on the hosted service: *.xport.sh) and routes traffic to the relays. It is the only public-facing component: relays and clients never need inbound ports.

Install

Section titled “Install”

Build from source (Go 1.27+):

Terminal window
go build -o gateway ./cmd/gateway

Requirements

Section titled “Requirements”
  • Go 1.27 or later

Build

Section titled “Build”
Terminal window
git clone https://github.com/xport-dev/xport-gateway.git
cd xport-gateway
go build -o gateway ./cmd/gateway

Configure

Section titled “Configure”

Copy the example configuration:

Terminal window
sudo mkdir -p /etc/xport
sudo cp config.example.yaml /etc/xport/gateway.yaml

server

Section titled “server”
Key Default Description
server.host 0.0.0.0 Address the gateway listens on
server.port 443 Port the gateway listens on
server.public_domain xport.sh Wildcard domain terminating here; the first DNS label routes

tls

Section titled “tls”
Key Default Description
tls.cert_file (empty) Wildcard certificate (e.g. *.xport.sh)
tls.key_file (empty) Private key

routing

Section titled “routing”
Key Default Description
routing.default_upstream (empty) Relay receiving all traffic without a table entry
routing.table {} Per-name upstreams, e.g. demo: http://10.0.0.2:8080

The gateway routes by the first DNS label of the Host header (the session name) and preserves the original Host header, so the relay can resolve the session. Unknown names fall back to the default upstream; without one they get a plain 404.

logging

Section titled “logging”
Key Default Description
logging.level info debug, info, warn, error

Every option also works as an environment variable: uppercase, XPORT_GATEWAY_ prefix, dots become underscores.

Run

Section titled “Run”
Terminal window
./gateway

GET /healthz is public and returns {"status":"ok"}; everything else is routed to the configured relays.