Serve and Funnel
Put a local port in front of the fleet, or in front of the internet, over a leaf certificate pinned in DNS.
On this page (6)
Serve and Funnel Documentation
A pair of verbs put a local port behind this node's own /128. serve answers your fleet. funnel answers the internet, and asks you to say so out loud. Both are decisions rather than deployments: the address is already globally routable, so there is nothing to propagate and nothing to wait for.
1. Put the port in front of your fleet
whisper whale serve 8123 --yes
Only your fleet is answered. The /128 is globally routable, so a stranger can still open the port; they get a 403 and nothing else. Useful flags:
| Flag | Does |
|---|---|
--allow | Answer extra addresses or prefixes beyond your fleet. Repeatable. |
--set-path | Mount the origin at this path instead of the root. |
--bg | Hold it in the background and return. |
--identity-headers | Stamp the identity headers on proxied requests. On by default. |
--https | The HTTPS port to serve on. 443, the port the published TLSA pins. |
--yes | Skip the confirmation, for scripts. |
Targets are accepted liberally: 3000, :3000, localhost:3000, [::1]:3000, http://127.0.0.1:3000/api.
2. Confirm what this host is serving
whisper whale serve status
The state is written to disk the moment serving starts, so whisper whale status shows it from any shell on this host, not only the one that started it.
3. Stop
whisper whale serve off
Idempotent: if nothing is running it says so and succeeds. There is no way to be left exposed by an off that thought it had nothing to do.
4. Answer the whole internet instead
whisper whale funnel 8123
This one asks you to type yes, or to pass --yes in a script. It takes the same flags as serve, and whisper whale funnel status and whisper whale funnel off mirror their counterparts. off on either verb stops whatever this host is serving, fleet or public, and removes the record.
What the origin receives
Your application does not have to work out who called. Each header below is established by Whalenet rather than claimed by the caller, and every Whisper-* header the caller sent is deleted before yours are stamped, so a header's presence is itself the proof. A claim that could not be established is absent rather than blank.
| Header | Carries |
|---|---|
Whisper-Client-Address | The calling address. Always present. |
Whisper-Agent-Address | The caller's /128, when it is a Whisper identity. |
Whisper-Agent-FQDN | That identity's canonical name. |
Whisper-Agent-Owner | Who holds it. |
Whisper-Assess-Band | The reputation band the Whisper graph holds for the caller. |
Whisper-Assess-Coverage | What that verdict was actually based on. |
Whisper-Identity-Proof | How each claim above was established, and how the missing ones failed. |
Whisper-Serve-Scope | fleet or internet. |
Read coverage before branching on a band: the coverage value is what says how much the band is based on.
Why the port is 443
The TLS leaf is pinned by the _443._tcp.<fqdn> TLSA record your node already publishes, so a caller verifies the certificate from the IANA DNSSEC root with no certificate authority involved and nothing pre-installed. That is why 443 is the port: move it and the published pin no longer describes what is answering. Keys, signing and encryption covers the record itself.
The /.well-known/ identity paths on a node's name are answered by Whisper and are never proxied to your origin, so a caller can always check the identity of the thing it is talking to.