SPIPED(1)

💖 SPIPED(1) — the spiped secure pipe daemon, from the spiped README 💖

okay bestie, sit down, hydrate, because we're learning spiped and it's genuinely iconic. it's a secure pipe daemon — like a little tunnel goblin that takes your connections and wraps them in encryption so nobody's snooping. 🦋

---

✨ SYNOPSIS ✨

spiped {-e | -d} -s <source socket> -t <target socket> -k <key file>
[-DFj] [-b <bind address>] [-f | -g] [-n <max # connections>]
[-o <connection timeout>] [-p <pidfile>] [-r <rtime> | -R] [--syslog]
[-u <username> | <:groupname> | <username:groupname>]
spiped -v

so basically you pick a mode (-e or -d, you MUST pick one, it's not optional), you tell it where to listen and where to connect, you hand it a key file, and it goes to work. slay. 💅

---

🌸 OPTIONS 🌸

• -e — take unencrypted connections from the source socket and send encrypted connections out to the target socket. this is the "encrypt my stuff on the way out" era.
• -d — the other direction, bestie: take encrypted connections from the source socket and send unencrypted connections to the target socket. decrypting queen. 👑
• -s <source socket> — the address where spiped should listen for incoming connections. the accepted formats are literally the same ones the target socket accepts. BUT — and this is important — contrary to target socket, hostnames here are resolved when spiped is launched and are not re-resolved later. so if DNS entries change, spiped will keep accepting connections at the expired address. it's loyal to a fault. 😭
• -t <target socket> — the address spiped should connect to. it has to be in one of these formats, no exceptions:
  • /absolute/path/to/unix/socket
  • host.name:port
  • [ip.v4.ad.dr]:port
  • [ipv6::addr]:port

hostnames get re-resolved every rtime seconds. ✨

• -k <key file> — use the provided key file to authenticate and encrypt. pass "-" to read from standard input. stdin girlies rise up. 🫶
• -b <bind address> — bind the outgoing address. if this is a network address, the port number may either be specified or left to the operating system. but heads up: if you specify the port number, the operating system will not let you open a second connection until the first one has completely expired (i.e. the TCP state is no longer in the TIME-WAIT state). so like, patience. 🧘
• -D — wait for DNS. normally when spiped is launched it resolves addresses and binds to its source socket before the parent process returns; with this option it will daemonize first and retry failed DNS lookups until they succeed. this lets spiped launch even if DNS isn't set up yet — but at the expense of losing the guarantee that once spiped has finished launching it will be ready to create pipes. trade-offs, bestie. ⚖️
• -f — use fast/weak handshaking: this reduces the CPU time spent in the initial connection setup by disabling the Diffie-Hellman handshake, at the expense of losing perfect forward secrecy. it's giving shortcuts. 💀
• -g — require perfect forward secrecy by dropping connections if the other host is using the -f option. boundaries! we love them. 🚫
• -F — run in foreground. this can be useful with systems like daemontools.
• -j — disable transport layer keep-alives. (by default they are enabled.)
• -n <max # connections> — limit on the number of simultaneous connections allowed. a value of 0 indicates that no limit should be imposed; this may be inadvisable in some circumstances, since spiped will terminate if it fails to allocate memory for handling a new connection. defaults to 100 connections. 💯
• -o <connection timeout> — timeout, in seconds, after which an attempt to connect to the target or a protocol handshake will be aborted (and the connection dropped) if not completed. defaults to 5s.
• -p <pidfile> — file to which spiped's process ID should be written. defaults to source socket.pid (in the current directory if source socket is not an absolute path). no file will be written if -F (run in foreground) is used.
• -r <rtime> — re-resolve the address of target socket every rtime seconds. defaults to re-resolution every 60 seconds.
• -R — disable target address re-resolution. set it and forget it. 🙈
• --syslog — after daemonizing, send warnings to syslog instead of stderr. has no effect if -F (run in foreground) is used.
• -u <username> | <:groupname> | <username:groupname> — after binding a socket, change the user to username and/or the group to groupname. glow-down for security reasons. 🔒
• -v — print version number. that's it, that's the whole option. ⭐

---

🎀 SIGNALS 🎀

spiped provides special treatment of the following signals:

• SIGTERM — on receipt of the SIGTERM signal, spiped will stop accepting new connections and exit once there are no active connections left. it's a graceful queen, it never just dips mid-conversation. 💅

---

🌈 SEE ALSO 🌈

spipe(1). go read it, bestie, iykyk. 📖

---

and that's the whole page, fr fr. this was spiped version 1.6.4, dated April 02, 2025 — no cap, that's the source and the date, so you know exactly which manual era you're in. mwah, go encrypt something. 💖✨🎀