Connecting over a VPN

Drover talks to Nomad's HTTP API (port 4646 by default) directly from your phone. Most clusters aren't on the public internet, and shouldn't be, so the usual route is the VPN tunnel you already use to reach them.

Through a VPN tunnel

Turn on your VPN on the phone and check that it routes the cluster's network.
In Drover, use an address the tunnel routes: a private IP (10.x, 172.16-31.x, 192.168.x, or a 100.64.0.0/10 address, where many VPN tunnels live), or a name your VPN's DNS resolves.
Leave Require a VPN on. Drover then fails fast with "No VPN tunnel" when the tunnel is down, instead of waiting for a timeout.

If your VPN app lets you choose which apps use the tunnel, include Drover. If it has a private DNS setting, make sure the cluster's names resolve with it on.

Without a VPN

Turn Require a VPN off to reach a cluster on your home network, or one served over HTTPS on a public address. Drover still checks where the address leads: a public address with ACLs or TLS off asks you before connecting, and you can connect read-only instead. See security warnings.

Plain HTTP inside a tunnel

Many Nomad agents serve plain HTTP and rely on the tunnel for encryption. Drover allows that, and shows a "No TLS" advisory so it's a choice you made. If the tunnel is the whole story for that cluster, mute the advisory for it.

TLS

Turn on Use TLS when the agents have tls.http on. Then:

Certificate authority. If the agents' certificates come from your own CA, import its PEM file. Drover trusts it for that cluster only.
Server name. Nomad's own certificates are issued for server.<region>.nomad (for example server.global.nomad), not for the address you dial. Put that name here and Drover checks the certificate against it.
Client certificate. If the agents require one (verify_https_client), choose a certificate installed on the phone, or import a .p12 or .pfx file with its password.
Skip certificate verification accepts any certificate, including one from someone pretending to be your agent. Traffic stays encrypted, but your token could go to them. Importing the CA is safer and takes one file.

When it doesn't connect

What you see	Try
No VPN tunnel	Turn the VPN on, or turn off Require a VPN for this cluster.
Can't resolve the name	The VPN's DNS isn't in use. Use the IP address, or check the VPN's DNS settings.
Connection timed out	The tunnel is up but doesn't route that network, or a firewall drops port 4646.
Certificate not trusted	Import the CA that signed the agent's certificate, and set the server name.
Needs Nomad 1.10+	Upgrade the agent you point Drover at; Drover supports Nomad 1.10 and newer.
Token not accepted	The token was revoked or belongs to another cluster or region. Paste a current one.