Deploy and operate

Overview

First verify a foreground server and client using the same release. On Linux, a systemd unit can supervise the server and collect stderr through journald. Use absolute paths for both the binary and server.toml. Keep the identity file readable only by the service identity and administrators. Configure the service identity and any low-port binding permission for your host rather than assuming every distribution has identical defaults.

Details

Open the configured public TCP port. Open UDP only if udp_listen is enabled and native QUIC is intended. If a separate layer-4 frontend owns the public port, bind backend listeners to loopback and configure transparent TCP/QUIC forwarding there. Internal backend ports do not need public firewall rules. A basic HTTP reverse proxy is not a replacement for the transport forwarding that Umbra requires.

Service unit example

Save this unit as /etc/systemd/system/umbra-server.service. It assumes a dedicated Linux user named umbra already exists, the binary is installed at /usr/local/bin/umbra, and /etc/umbra/server.toml is readable by that user. Create the service identity and install those files using your host’s administration tools before enabling the unit; adjust the paths and user if your deployment differs.

[Unit]
Description=Umbra Server
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=umbra
ExecStart=/usr/local/bin/umbra server -c /etc/umbra/server.toml
AmbientCapabilities=CAP_NET_BIND_SERVICE
NoNewPrivileges=true
Restart=on-failure
RestartSec=5
LimitNOFILE=65535

[Install]
WantedBy=multi-user.target

Service controls

sudo systemctl daemon-reload
sudo systemctl enable --now umbra-server
sudo journalctl -u umbra-server -f

Verify

Budget memory with operating-system headroom. The documented throughput deployment assumes at least 1 GiB of physical server RAM; performance.memory_mib is a logical application commitment ceiling, not a process RSS limit. Default diagnostics are disabled. Enable a bounded diagnostics interval only when investigating performance and interpret counters as observations, not proof of remote delivery. Restart deliberately after configuration changes and keep a previously verified binary available for rollback.