Expose a port publicly

Any HTTP service running on one of your hosts can get a public HTTPS address served by the DedNets edge. The hostname is derived automatically as {app}-{username}.{domain}; TLS certificates are issued on demand at the first request. You never open a port on your own network: traffic enters at the edge and rides the daemon’s existing outbound connection.

There are three ways to mark a service public. All of them end up in the same place; pick whichever fits how the service runs.

From the Console (no config at all)

On the Services page, each host card lists the containers the daemon discovered. Click Expose on a container, pick the port and protocol, and the dialog shows a live preview of the public hostname.

For something that is not in a container (a dev server, a systemd service), use the host card’s Expose host port action: give it an app name, the port it listens on locally, and the protocol. The daemon dials it on 127.0.0.1.

Either way the service appears in the host’s list with a health badge: the daemon probes the backend every 30 seconds from the machine itself, so the Console shows whether the published port is actually alive.

Unpublish from the same row removes the export and its public hostname.

With Docker labels

If you prefer the service to declare itself, label its container:

# docker compose example
services:
  blog:
    image: ghost
    labels:
      dedmesh.enable: "true"
      dedmesh.port: "2368"
      dedmesh.name: "blog"      # default: the container name
      dedmesh.protocol: "http"  # http (default) | tcp | udp
      dedmesh.public: "true"    # request the public hostname

The daemon watches Docker events, so starting the container publishes the app and stopping it unpublishes it. No Console clicks needed.

In the daemon’s config file

For a daemon run from a config file, add the app there:

[[apps]]
name = "blog"
protocol = "http"
local_host = "127.0.0.1"
local_port = 2368
public = true

What about raw TCP and UDP?

The shared DedNets edge publishes raw TCP/UDP ports only for admin accounts, in a high port range. For everyone else the route to public raw TCP/UDP is a gateway: one of your own hosts (say, a VPS) publishes the port on its own address, any port you like, including 80, 443, or 53. See Publish on your own gateway.

Services that should not be public at all can stay mesh-only: other daemons of yours (or users you share the app with) reach them through local proxy ports, and nothing is exposed to the internet.