Docs / Getting started / Introduction
Getting started
ingressd publishes web apps and game servers from your home through edge nodes on servers you rent. This page explains the parts and the order to set them up in.
Preview
ingressd is in development and the panel is not open to the public yet. Commands and screens can still change.
How it fits together#
ingressd has four parts. You run three of them; the panel is hosted.
| Part | Runs on | Does |
|---|---|---|
Node (ingressd, with ingressd-edge) |
A VPS with a public IP | Accepts traffic for your hostnames and ports, terminates TLS, applies the WAF and access policies, and passes requests down a tunnel to your home. |
Home side (ingressd-connector, or your router) |
A machine in your home, or the router itself | Dials out to every node over WireGuard. Nothing listens on your home connection. |
| Panel | app.ingressd.com | Holds your configuration, compiles it for each node, signs it and pushes it over an outbound connection the node opens. Shows health, usage and live logs. |
| Edge DNS | The panel | Answers each app's DNS target with the nodes that can currently reach the app's home. |
Visitors never touch the panel: they connect to a node, and the node reaches your service through the tunnel. The panel only stores configuration, health and usage counters.
What you need#
- A VPS running Debian or Ubuntu on amd64 or arm64, with a public IPv4 address. A second VPS, ideally with another provider or in another city, gives you failover.
- A machine at home that can run the connector (Linux, macOS, Windows or Docker), or a router with a WireGuard client: UniFi, pfSense, OPNsense, MikroTik or OpenWrt.
- A domain whose DNS you can edit, for web apps. Game servers can use a hostname or the node's IP.
Set it up in this order#
- Install a node on your VPS and enrol it with the panel. Repeat for each node.
- Connect your home, either with the connector or with your WireGuard router. The home attaches to all of your nodes by default.
- Publish a web app or a game server.
- Optional: put access policies in front of private apps, add more nodes for failover, or route chosen services through Smart DNS.
Words used in these docs#
- Home: one network you publish from. The panel calls it a home; node config calls it a site or tunnel.
- Node: one server running
ingressd serve. Each node can belong to a PoP, a named location such as a city or datacentre. - Attachment: a home's tunnel to one node. A home has one attachment per node it uses, up to 16.
- App: something you publish. HTTP apps get a hostname and certificate; game and TCP/UDP apps get ports.
- DNS target: a name such as
k7m2q9xa.edge.example.netthat the panel creates for each app. You point your own hostname at it with a CNAME.
Without the panel#
The node also runs on its own from a config.yaml file and the ingressd CLI, with no account. See standalone mode.