Security model

mytunnel treats the edge daemon as the security boundary. Client flags are convenient input, not authority.

Trust boundaries

Boundary	Rule
Client to edge	SSH authenticates the remote OS user.
Owner identity	mytunneld derives owner from the SSH OS user.
Control commands	Forced-command keys should allow only mytunneld ctl shapes.
Lease DB	Only the daemon/control command path should mutate leases.
Caddy Admin API	Must be reachable only from loopback.
Public HTTP traffic	Untrusted internet traffic reaches the local app through Caddy and SSH.
Scripts	Install and upgrade scripts can write privileged files; run them from trusted source.

Owner scoping

The server ignores client-supplied owner values. For allocate, the effective owner is the SSH OS user running mytunneld ctl allocate. For list, heartbeat, release, and delete, the same SSH user must own the lease.

This prevents one SSH user from stopping or deleting another user’s leases.

Admin users and slug takeover

--force can replace an existing active slug only when the caller is privileged. Privileged callers are:

• root
• Usernames listed in MYTUNNEL_ADMIN_USERS

Set admin users on the edge:

sudoedit /etc/mytunneld/mytunneld.env
sudo systemctl restart mytunneld

Example value:

MYTUNNEL_ADMIN_USERS=admin,ops

Then:

mytunnel http 3000 --edge admin@edge.example.com --base-domain tunnel.example.com --name portal --force

Use admin users sparingly. Force takeover deletes the existing lease and route for that slug.

SSH forced-command model

Install a dedicated tunnel SSH user and key:

sudo ./scripts/install-edge-ssh-key.sh mytunnel-client ./id_ed25519.pub

The gate allows:

• Empty remote command for long-running reverse tunnel sessions.
• mytunneld ctl allocate
• mytunneld ctl heartbeat
• mytunneld ctl release
• mytunneld ctl delete
• mytunneld ctl list
• mytunneld ctl health
• mytunneld ctl reconcile
• mytunneld ctl stats

The gate rejects daemon config override flags, including:

• --db-path
• --base-domain
• --caddy-admin-url
• --caddy-server
• --min-port
• --max-port
• --lease-ttl
• --cleanup-interval
• --reconcile-interval
• --health-timeout
• --log-format
• --max-leases-per-owner
• --admin-users

Test gate behavior locally:

./scripts/test-ssh-gate.sh

Caddy Admin API

The Admin API can add, remove, and edit routes. Keep it on loopback:

{
  admin 127.0.0.1:2019
}

mytunneld refuses non-loopback Admin API hosts. check-edge.sh also fails when the configured Admin API URL is not loopback-scoped.

Do not firewall-publish 2019/tcp.

Filesystem permissions

Expected defaults:

Path	Expected mode	Why
/etc/mytunneld/mytunneld.env	0600 or 0640	May contain sensitive operational config.
/var/lib/mytunneld/leases.db	0600 or 0660	Contains lease state and owner data.
/var/lib/mytunneld	setgid daemon group	Allows the service and forced-command user group to coordinate safely.
/usr/local/bin/mytunneld	0755	Executable by systemd and ctl users.

Check permissions:

sudo ./scripts/check-edge.sh

Secrets handling

DNS provider tokens should:

• Be scoped to the smallest feasible DNS zone and permission set.
• Live in systemd environment drop-ins or another secret manager.
• Not be committed to the repo.
• Not be echoed in install logs.

For Infomaniak bootstrap, the installer writes a restricted systemd drop-in for INFOMANIAK_API_TOKEN when --infomaniak-token is passed.

Public exposure warnings

mytunnel publishes your local HTTP service. It does not add:

• Login screens.
• Request authorization.
• CSRF protection.
• Rate limiting.
• Data redaction.

Before tunneling a service, decide whether it is safe for any internet client to reach it. For real production traffic, put authentication and authorization in the app or in a reverse-proxy layer in front of the app.

Recommended edge hardening

• Use key-only SSH.
• Use a dedicated tunnel SSH user where practical.
• Use the forced-command gate for tunnel users.
• Keep Caddy Admin API loopback-only.
• Expose only SSH, 80/tcp, and 443/tcp.
• Use UFW ALLOW, not LIMIT, on the tunnel SSH port.
• Keep fail2ban or equivalent enabled.
• Keep DNS provider tokens scoped and rotated.
• Test rollback before relying on upgrades.