Address and router

A free hyperdrop.link name

A free address is <name>.hyperdrop.link: 5 to 32 lowercase letters, digits and hyphens. HyperDrop registers it and keeps its record pointed at your server.

The name belongs to your HyperDrop account (gethyperdrop.com/account, sign in with Google or Apple). Approve it when asked: Server Management shows the step during setup; HyperDrop Desktop offers Open Account on the server's Domain row while approval is pending. Before publishing, the service checks that your server answers on port 80 at your public address.

One server holds a name at a time. On a replacement server, enter the same name and approve it in the same account. Disconnecting removes the record; the account keeps the name.

Your own domain

Use a dedicated subdomain such as share.example.com. Pointing the apex at HyperDrop moves your whole domain.

The certificate is issued once both names resolve to the server and port 443 reaches it. To change the domain later: Servers, the server, Change Domain…. The command line prints the records too:

hyperdrop dns records share.example.com --ip 203.0.113.10

The two DNS records

Behind a home router, both carry the router's public IPv4.

The files. record is required: uploaded files are served from that separate name so an uploaded web page cannot act on the address your links use.

Creating the records for you, and when your public IPv4 changes

If your DNS is at a provider HyperDrop can drive, Change Domain… asks where it is hosted and creates both records with the credential you paste. That is a one-time step and the credential is not kept: when your server's public address never changes, as on most VPSes, nothing more is needed.

When the address can change, as behind most home routers, HyperDrop can keep both records current: in Domain & Connectivity…, choose Set up automatic DNS… and one of:

• A provider from the list, today Cloudflare: HyperDrop finds the zone, creates a missing record or updates one that already points at this server, and keeps both current with the credential, which is stored on your server. It never deletes, and refuses the whole change if either name is a CNAME, has more than one A record, or points somewhere else.
• Advanced: an HTTPS request recipe, written by hand, for another DNS provider whose API takes a plain token or an initial login (an API that signs every request needs a signing gateway in between).
• No updates needed: the address never changes, or your router, NAS or another updater keeps the records current; HyperDrop only checks them.

With a provider or Advanced the server runs the updates itself, so they continue while your Mac sleeps; with an updater of your own, that updater has to keep running. A free hyperdrop.link name needs none of this: it follows your IPv4 on its own.

Cloudflare

1. Open the API Tokens page in your Cloudflare account.
2. Click Create Token, then use the "Edit zone DNS" template.
3. Under Zone Resources, choose the zone that holds your domain.
4. Continue to summary, then Create Token.
5. Copy the token. Cloudflare shows it only once. Paste it into HyperDrop.

The template's token can find the zone by name. If yours is scoped so that it cannot, HyperDrop asks for the Zone ID instead, shown on the zone's Overview page. Records get a TTL of 60 seconds and Cloudflare's proxy is kept off, because the server serves its own certificate.

Signing in before the name exists

Until the domain resolves, the server answers at https://<public IPv4>. Join with that address; the app moves to the domain once it answers as the same server. Behind a router the public address is the router's, and a router without NAT loopback needs the Mac on another network for it.

Router forwards

A router forwards by port number, never by name. Forward:

• Port 443 (TCP) to the server's HTTPS port (443 on Linux, 5443 on a NAS), always: links and the certificate come through it.
• Port 80 (TCP) to the HTTP port (80 on Linux, 5080 on a NAS): needed for a free name, whose approval check arrives there; optional for your own domain, where it only redirects http:// to HTTPS.

The server checks its forwards from outside every 30 minutes and on every check you run: Servers, the server, Domain & Connectivity…, Check & update DNS (Run DNS & HTTPS checks when you manage the DNS records yourself); a missing forward or one leading to another device shows as a warning under the domain. hyperdrop domain status prints the same on its router: line. DSM's Router Configuration screen can create the forwards for a NAS.

If port 443 or 80 already goes to another device, see When ports 443 and 80 are taken.

Carrier-grade NAT

Some ISPs share one public address between many homes, which is called carrier-grade NAT. Your router's internet-side address is then one of the ISP's own (in 100.64.0.0/10, the range reserved for it) rather than a public one, so no forward you set on the router can deliver a connection to the server. The Domain screen and hyperdrop domain status say so, and say nothing about forwards while it lasts, since none can work.

Ask your ISP first. Most ISPs can move a connection onto a public IP address, also called a real, white or routable address, and many do it free of charge on request: online games and consoles need one too, so support knows the request. Others sell it as an option, a static address usually for a small monthly fee. Either kind works, because HyperDrop does not need a static address: a free hyperdrop.link name follows an address change on its own, and your own domain does through automatic DNS. Once the ISP has switched you, restart the router so it takes the new address, then run the check again (Servers, the server, Domain & Connectivity…, Check & update DNS, or hyperdrop domain status); the warning clears when the router's address is public, and the forwards are judged from then on.

A router whose internet-side address is a private one (10., 172.16. to 172.31. or 192.168.) sits behind another router. When that is your ISP's modem, ask them to set it to bridge mode, or forward 443 and 80 on it to your router. When it is the ISP's network itself, that is carrier-grade NAT under another address, and the same request for a public address applies. A mobile (4G or 5G) connection is almost always shared this way, and a public address on one is rarely offered.

If your ISP cannot give you a public address, install on a VPS instead. Tunnels such as Cloudflare Tunnel or Tailscale Funnel are not supported, nor is IPv6.