DERP Server for Tailscale

Derper is a self hosted DERP (Designated Encrypted Relay for Packets) server, designed to be used with Tailscale.
This snap provides a simple and secure way to run your own DERP servers to route your tailscale traffic through your own relay servers.

Please refer to the upstream documentation for more information:

• https://tailscale.com/kb/1118/custom-derp-servers
• https://tailscale.com/kb/1232/derp-servers
• https://github.com/tailscale/tailscale/blob/main/cmd/derper/README.md

Usage

Install the snap:

sudo snap install derper

This installs the DERP server and starts it automatically.
You will likely need to configure the service:

Configuration

You can modify configuration options with sudo snap set. The following configuration options are currently supported:

• hostname: LetsEncrypt host name, if addr's (a) port is :443. (default if unset: "derp.tailscale.com")
• a: server HTTP/HTTPS listen address, in form ":port", "ip:port", or for IPv6 "[ip]:port". If the IP is omitted, it defaults to all interfaces. Serves HTTPS if the port is 443 and/or certmode is manual (default certmode is "letsencrypt"), otherwise HTTP. (default if unset: ":443")
• stun-port: The UDP port on which to serve STUN. The listener is bound to the same IP (if any) as specified in the a option. (default if unset: "3478")
• verify-clients: Verify clients to this DERP server through a local tailscaled instance. Must be "true" or "false". (default if unset: "false")

The config options correspond to the similarly named command line flags for derper.

Options that don't have support to be configured through the snap will be left on their default.
See the derper command source code at https://github.com/tailscale/tailscale/tree/main/cmd/derper for more technical information on options.

Example of setting an option:

sudo snap set derper hostname=myderper.mydomain.com

To view the available config options and their current values:

$ sudo snap get derper

Key             Value

hostname

a               127.0.0.1:443

verify-clients  false

...

Derper must be restarted manually for the changed config to take affect:

sudo snap restart derper

To run in verify-clients mode, the tailscale snap must also be installed,
and the two snaps connected over the custom content interface so the control socket is shared:

sudo snap install derper

sudo snap install tailscale

sudo snap connect derper:tailscale-socket tailscale:socket

sudo snap set derper verify-clients=true

sudo snap restart derper

Security

See https://github.com/canonical/derper-snap/blob/main/docs/security-reference.md
for security and hardening documentation.

This snap is maintained by Canonical, and is not necessarily endorsed or officially maintained by the upstream developers.