Skip to content
mytunnel

mytunnel

mytunnel is a small self-hosted tunnel system for exposing local HTTP apps through a public hostname you control. It uses SSH reverse forwarding for the data plane and Caddy’s Admin API for dynamic HTTPS routes at the edge.

It is for operators who want an ngrok-style workflow without handing traffic, DNS, or tunnel ownership to a hosted tunnel provider. It is not a replacement for application authentication, a private network, or a managed zero-trust proxy.

Start with the quickstart

Run an edge server

Control-plane diagram
Terminal window
git clone <repo-url> tunneled
cd tunneled
make build
mytunnel http 3000 --edge mytunnel-edge --base-domain tunnel.example.com --name portal

That command prints:

url: https://portal.tunnel.example.com
lease: <id>

Shortest path

Clone, build, install the edge daemon, install the client, run preflight checks, and start one tunnel.

Quickstart

Operator runbook

Set wildcard DNS, choose the Caddy ACME DNS provider, install services, check logs, reconcile routes, and recover from stale leases.

Edge operations

Security model

Understand SSH owner scoping, forced-command keys, Caddy Admin API loopback rules, filesystem permissions, admin takeover, and exposure risks.

Security model

Exact commands

Reference every mytunnel, mytunneld, and operator script command from the current source tree.

CLI reference

How it works

Section titled “How it works”
Data-plane diagram
  1. mytunnel calls mytunneld ctl over SSH to allocate a lease.
  2. mytunneld derives the owner from the SSH OS user, persists the lease in SQLite, and adds a Caddy route.
  3. The client starts a dedicated ssh -R process from an edge loopback port to your local app.
  4. Caddy terminates HTTPS for https://<slug>.<base-domain> and proxies to the loopback edge port.

Current distribution model

Section titled “Current distribution model”

This repository is source-first in the current cycle. Build from source locally or with Docker, then install the binaries with the provided scripts. Published release binaries can be added later without changing the operator model.

Start with Quickstart if you want the first working tunnel, or Installation if you are preparing the edge host.