SIGNAL-TLSD(1)

💅 signal-tlsd 💅

okay bestie, so signal-tlsd is a whole thing and i'm obsessed?? it's the standalone Rust implementation of Signal's domain fronting TLS proxy. like, signal's own TLS proxy but as a single Rust binary doing its own thing. main character energy fr fr ✨

🌸 SYNOPSIS 🌸

signal-tlsd [OPTIONS]

that's it. that's the whole vibe. flags only, no positional args, no drama 💖

🦋 DESCRIPTION 🦋

Standalone Rust implementation of Signal's domain fronting TLS proxy.

ngl that one sentence is doing a LOT of work but it's accurate and it's slaying, so. it's a TLS proxy, it does domain fronting, it's written in Rust, and it stands alone (no depending on the rest of the Signal stack to hold its hand 🫶).

✨ OPTIONS ✨

• -v, --verbose... — turn the log level UP ⬆️ and yes you can stack it, so setting it multiple times keeps cranking the verbosity. more -v = more words, iconic behavior.
• -q, --quiet... — turn the log level DOWN ⬇️. cute little thing: if you do it twice, it fully turns off error logging too. so double -q is the "i want SILENCE" button 💀
• -B, --bind <BIND> — the address it binds to. reads from the env var BIND_ADDR=, and if you say nothing at all it defaults to 127.0.0.1:4443 🌈
• -A, --allow <ALLOW> — the allowed destination server names. heads up bestie: this replaces the default signal.org allowlist, it doesn't add to it. and you can set it multiple times to list a bunch of names 💅
• -F, --fallback <FALLBACK> — the fallback destination it uses when the inner connection isn't TLS, or when the SNI value isn't on the allowlist. give it as <addr>:<port>. it also reads env SIGNAL_TLSD_FALLBACK_ADDR= 🎀
• -N — do not expect an outer TLS layer. basically you're telling it "assume the outer TLS layer has already been terminated," so it skips right past that. no args, just vibes ✨
• --cert <CERT> — path to the TLS certificate for the outer TLS layer, PEM format. env var: TLS_CERT_PATH= 🍓
• --private-key <PRIVATE_KEY> — path to the TLS private key for the outer TLS layer, PEM format. env var: TLS_PRIVATE_KEY_PATH= 🔥
• -h, --help — print help. your bestie when you forget a flag 🫶
• -V, --version — print version. short and sweet 👑

quick reminder babe: -A/--allow replaces the default signal.org allowlist, it does not extend it. don't come crying to me when signal.org isn't allowed anymore because you set your own list 🙈

🌟 a lil sign-off 🌟

this page is for signal-tlsd version 0.1.4, dated August 2026 — and that's the whole manual bestie, you ate that, go run it 💖🧚✨