Hyper-DERP v0.2.0

What's new

hyper-derp now does WireGuard.

WireGuard relay mode

Two NAT'd peers point their Endpoint = at hyper-derp; the relay forwards UDP between them. Works with stock wg, wg-quick, pfSense, and the mobile WireGuard apps — no client-side changes.

Optional XDP fast path forwards in the kernel, hitting 10.4 Gbit/s on 25 GbE bare-metal and 3.7 Gbit/s on a 4-vCPU GCP VM.

Homelab quickstart — eight copy-paste steps from a clean Debian box.

One-package install

apt install hyper-derp now ships everything you need: the operator CLI is bundled, the systemd unit comes pre-configured, and the IPC dir is set up by the postinst. Nothing else to do.

Naming

hd-cli → hdcli, hd-wg → hdwg to line up with the existing hdctl / hdcat. Pre-release rename — no compat aliases.

DERP path

Unchanged. Still drop-in compatible with Tailscale, Headscale, and any standard DERP client.

Install

curl -fsSL https://hyper-derp.dev/repo/key.gpg | \
  sudo gpg --dearmor -o /usr/share/keyrings/hyper-derp.gpg

echo "deb [signed-by=/usr/share/keyrings/hyper-derp.gpg] \
  https://hyper-derp.dev/repo stable main" | \
  sudo tee /etc/apt/sources.list.d/hyper-derp.list

sudo apt update && sudo apt install hyper-derp
hdcli                # operator REPL

Full changelog: CHANGELOG.md · Bench numbers: HD.Benchmark

v0.1.5

Full Changelog: v0.1.4...v0.1.5

v0.1.4

Full Changelog: v0.1.3...v0.1.4

v0.1.3

Full Changelog: v0.1.2...v0.1.3

v0.1.2

Full Changelog: v0.1.1...v0.1.2

v0.1.1

Full Changelog: v0.1.0...v0.1.1

v0.1.0

Hyper-DERP v0.1.0

Initial release. Drop-in replacement for Tailscale's Go-based derper.

Highlights

• 2-11x higher throughput than Go derper across 2-16 vCPU configs (GCP c4-highcpu, kTLS vs TLS)
• Sub-2% packet loss at all tested rates — Go derper hits 16-92% loss at saturation
• 16-48x fewer TCP retransmits through real WireGuard tunnels
• Compatible with Tailscale, Headscale, and any standard DERP client

Architecture

• io_uring sharded workers with multishot recv, SEND_ZC, provided buffer rings
• kTLS — kernel handles AES-GCM, offloadable to NIC
• SPSC lock-free cross-shard rings, zero allocation on hot path
• Backpressure via recv pause with adaptive hysteresis

What's included

• hyper-derp relay server binary
• derp-test-client, derp-scale-test, derp-tun-proxy benchmark tools
• YAML config file support (rapidyaml)
• systemd service unit (hardened, DynamicUser)
• Prometheus metrics endpoint

Install

sudo dpkg -i hyper-derp_0.1.0_amd64.deb
sudo vi /etc/hyper-derp/hyper-derp.yaml
sudo systemctl start hyper-derp

Build from source

cmake --preset default
cmake --build build -j

Requires Linux kernel 6.1+, Clang 19 or GCC 14, liburing, libsodium, OpenSSL 3.x.