server

May 11, 2026

Changes in this version

+ const DefaultMaxVisitorsPerTunnel

+ var ErrAuthFailed = errors.New("rift: authentication failed")

+ var ErrIPBlocked = errors.New("rift: source IP blocked by rate limiter")

+ var ErrTokenExpired = errors.New("rift: token expired")

+ var ErrTokenRevoked = errors.New("rift: token revoked")

+ var ErrTunnelGone = errors.New("rift: tunnel connection closed")

type AdminSecretIssuer

+ func (a *AdminSecretIssuer) SetAuthRL(rl *rateLimiter)

+ func (a *AdminSecretIssuer) SetRevokes(r *RevokeRegistry)

+ func (a *AdminSecretIssuer) SetTrustProxyHeaders(trust bool)

type Registry

+ func (r *Registry) RegisterWT(subdomain string, conn *quic.Conn, allowedOrigins, allowedWTProtocols []string) (*Tunnel, error)

+ type RevokeRegistry struct

+ func NewRevokeRegistry() *RevokeRegistry

+ func (r *RevokeRegistry) Count(name string) int

+ func (r *RevokeRegistry) Register(name string, fn func()) func()

+ func (r *RevokeRegistry) Revoke(name string) int

type Server

+ func (s *Server) Addr() net.Addr

+ func (s *Server) Revokes() *RevokeRegistry

+ func (s *Server) SetTokenIssuer(iss TokenIssuer)

+ func (s *Server) Shutdown(ctx context.Context) error

type Tunnel

+ AllowedOrigins []string

+ AllowedWTProtocols []string

+ func (t *Tunnel) AddWTSession(s any) uint32

+ func (t *Tunnel) GetWTSession(id uint32) any

+ func (t *Tunnel) OpenDataStream(ctx context.Context) (*quic.Stream, error)

+ func (t *Tunnel) OpenDataUniStream(ctx context.Context) (*quic.SendStream, error)

+ func (t *Tunnel) RemoveWTSession(id uint32)

Apr 19, 2026

Changes in this version

+ var ErrPortsExhausted = errors.New("no TCP ports available in configured range")

+ var ErrSubdomainTaken = errors.New("subdomain already in use")

+ func DevTLSConfig(domain string) (*tls.Config, error)

+ func ProdTLSConfig(domain, cacheDir string) (*tls.Config, http.Handler)

+ type AdminSecretIssuer struct

+ func NewAdminSecretIssuer(secret string, ts store.TokenStore, defaultTTL time.Duration, log *zap.Logger) *AdminSecretIssuer

+ func (a *AdminSecretIssuer) Match(r *http.Request) bool

+ func (a *AdminSecretIssuer) ServeHTTP(w http.ResponseWriter, r *http.Request)

+ type Registry struct

+ func NewRegistry(portMin, portMax uint16) *Registry

+ func (r *Registry) ByID(id uint32) *Tunnel

+ func (r *Registry) BySubdomain(subdomain string) *Tunnel

+ func (r *Registry) RegisterHTTP(subdomain string, conn *quic.Conn) (*Tunnel, error)

+ func (r *Registry) RegisterTCP(conn *quic.Conn) (*Tunnel, error)

+ func (r *Registry) Unregister(id uint32)

+ type Server struct

+ func New(cfg config.ServerConfig, ts store.TokenStore, tlsCfg *tls.Config, ...) *Server

+ func (s *Server) Run(ctx context.Context) error

+ type TokenIssuer interface

+ Match func(r *http.Request) bool

+ ServeHTTP func(w http.ResponseWriter, r *http.Request)

+ type Tunnel struct

+ Conn *quic.Conn

+ ID uint32

+ Port uint16

+ Proto string

+ Subdomain string

+ func (t *Tunnel) TryAddVisitor() bool

+ func (t *Tunnel) VisitorDone()