dropclip

Downloads

Current version: 0.0.1.144+g816d47f

The binary by itself doesn't connect to anything. You also need a config.yaml from whoever runs your group's hub — it's what has your WireGuard key, the hub's address, and your bearer token baked in. Ask them for it and put it next to the executable before you run it.

No installer for macOS/Windows binaries — a single executable is the whole app. Admin/root is required on every platform because dropclip brings up a real OS WireGuard interface (see below), not because of anything the app itself needs elevated access for.

Hub operator tools

Only relevant if you're standing up the hub itself — dropclip-admin is the enrollment CLI that generates a new friend's keypair and both config files. The .deb above already bundles it, so this is only for a hub run from a raw binary instead.

How it works

Every machine in the mesh — hub or spoke — runs the exact same binary. What differs is one config field (role: hub or role: spoke) and whether a port is forwarded to it.

Each spoke dials the hub outbound over UDP — the same thing that works through virtually any home NAT/router with zero configuration. There is no full mesh at the WireGuard layer: a spoke has exactly one WireGuard peer, the hub, and no direct network path to any other spoke at all.

Where a video actually goes

So how does Alice watch Bob's clip? It's relayed — at the HTTP layer, not the WireGuard layer.

Each WireGuard leg is fully encrypted, but the hub terminates both of them and proxies the decrypted bytes at the application layer — that's what makes it a hub-and-spoke reverse proxy instead of packet-level routing. Practically: the hub operator's machine can see plaintext clip data in transit. That's a deliberate, disclosed tradeoff for a hub run by one of your close friends, not an oversight — see "Security" below.

It also means every relayed clip costs the hub two legs at once, roughly 8–15 Mbps each for a typical 1080p60 clip — on most home connections it's the hub's upload bandwidth that's the real constraint, since a couple of concurrent viewers can already saturate a typical cable/DSL upload pipe. A symmetric fiber connection doesn't have this problem.

The rest of it

• Real WireGuard, not a userspace shim. Every node brings up a genuine OS TUN device — the kernel's own network stack, not a userspace reimplementation of one. That's why admin/root is required: an earlier version tried to avoid that by staying entirely userspace, but the kernel's TCP stack noticeably outperforms it, especially over WiFi.
• Catalog polling. The hub periodically polls every reachable spoke for its clip list and merges them into one catalog; spokes poll the hub for that merged list plus each peer's online/degraded/offline state — so a friend's sleeping laptop just grays out instead of breaking the page for everyone else.
• Scrubbing works. The file server supports HTTP range requests, so seeking around in a clip in the browser behaves normally instead of re-downloading from the start.
• Showcase. Instead of copy-pasting a link, you can hit "showcase" on a clip you're watching (yours or a friend's) and it shows up as a one-click pointer next to your name on everyone else's dashboard within one poll cycle.
• Self-update (Windows). A spoke checks the hub on every startup, and if the hub is serving a newer build, downloads it, verifies its sha256, swaps itself out for the new binary, and relaunches — no separate updater to run by hand.

Security

WireGuard itself does most of the work: every peer authenticates by keypair, and the protocol doesn't even respond to a packet from an unrecognized key — the mesh is effectively invisible to a port scanner. Nobody joins without the hub operator generating their key and adding it to the hub's config by hand.

On top of that, every request over the tunnel — file downloads, catalog fetches, the relay proxy — also requires a per-client bearer token issued at enrollment. That closes the narrower gap WireGuard alone doesn't: something on the tunnel network that isn't supposed to browse files still can't, without its own token.