overpass is the daemon. It runs either the control plane or a node agent.

overpass server

Runs the control plane (auth + proxy + web UI). Reads /etc/overpass.yaml (or /etc/overpass.yml) by default. Explicit YAML values override flags and environment fallbacks; configuration made through the web UI persists in the server-managed config directory inside the data directory (<data_dir>/overpass.d).

Flag	Default	Purpose
--config	/etc/overpass.yaml	config file path
--cluster-name	overpass	cluster name
--data-dir	/var/lib/overpass	data directory (DB, CA keys, TLS cert)
--web-addr	0.0.0.0:8443	HTTPS listen address (UI + API)
--ssh-addr	0.0.0.0:3023	client SSH routing
--tunnel-addr	0.0.0.0:3024	node tunnel listen address
--grpc-addr	0.0.0.0:3025	gRPC API listen address
--public-addr	—	external host for SSH/gRPC dialing + cert SANs
--public-url	—	external base URL for the web UI / OIDC (behind a proxy)
--trusted-proxies	—	reverse proxy IPs/CIDRs trusted to supply X-Forwarded-*
--tls-routing	false	advertise the web port as the single endpoint for clients and nodes (TLS ALPN routing)
--debug	false	shorthand for --log-level debug
--log-level	logging.level, else info	debug, info, warn, error or fatal
--log-format	logging.format, else text	text, json or logfmt

overpass server --config /etc/overpass.yaml

See Configuration for the file format and Behind a reverse proxy for --public-url and --trusted-proxies.

overpass node

Runs a node agent: enrolls with the proxy and serves SSH over a reverse tunnel.

Flag	Default	Purpose
--name	hostname	node name
--proxy	—	proxy gRPC address host:port (required, for enrollment)
--tunnel	learned at enrollment	proxy tunnel address
--token	—	join token (first run only)
--data-dir	platform default	node data directory (/Library/Application Support/Overpass on macOS; /var/lib/overpass-node elsewhere)
--labels	—	node labels k=v (comma-separated)
--insecure	false	skip TLS verification of the proxy (dev)
--debug	false	shorthand for --log-level debug
--log-level	logging.level, else info	debug, info, warn, error or fatal
--log-format	logging.format, else text	text, json or logfmt

overpass node --name web-1 --proxy gate.acme.com:3025 --token <token> --labels env=prod

See Onboarding nodes.