remote-passive.man

.IP "\fBpssl:\fIport\fR[\fB:\fIip\fR]"
.IQ "\fBptcp:\fIport\fR[\fB:\fIip\fR]"
Listen on the given SSL or TCP \fIport\fR for a connection.  By
default, connections are not bound to a particular local IP address
and it listens only on IPv4 (but not IPv6) addresses, but specifying
\fIip\fR limits connections to those from the given \fIip\fR, either
IPv4 or IPv6 address.  If \fIip\fR is an IPv6 address, then wrap
\fIip\fR with square brackets, e.g.: \fBpssl:6640:[::1]\fR.  On Linux,
use \fB%\fIdevice\fR to designate a scope for IPv6 link-level
addresses, e.g. \fBpssl:6653:[fe80::1234%eth0]\fR.  For \fBpssl\fR,
the \fB\-\-private\-key\fR, \fB\-\-certificate\fR, and
\fB\-\-ca\-cert\fR options are mandatory.
.
.IP "\fBpunix:\fIfile\fR"
On POSIX, listen on the Unix domain server socket named \fIfile\fR for a
connection.
.IP
On Windows, listen on a local named pipe.  A file is created in the
path \fIfile\fR to mimic the behavior of a Unix domain socket.