Expose local HTTP through a QUIC control tunnel and streaming HTTPS/HTTP/3 ingress. Scale with load-balanced barges (process or k3s), restore tunnel inventory from snapshots, join mesh/VPI, or co-host product apexes with vhosts.
LB mode assigns subdomains to backends (sticky or round-robin). Barge fleets auto-register and scale without rewiring clients.
Clients dial tunnel.tunneltug.com over UDP with TLS (ALPN: tunneltug). Yamux multiplexes many concurrent streams per tunnel.
Ingress tuned for SSE and WebSockets over HTTPS and HTTP/3 — not just short request/response.
Run server replicas as a StatefulSet so web deploys do not hard-reset the fleet. Rolling image updates keep N-1 backends live.
Before shutdown or image roll, each barge writes tunnel inventory under a hostPath. On start, mesh records restore and clients re-dial pending tunnels.
Multi-tenant host routing — myapp.tunneltug.com points at your local :3000. Optional namespaces for fleet isolation.
Publish myapp.tunneltug.tunnel, resolve .mesh / .social / .tunnel locally, or load zone-specific DNS-over-HTTPS via dns.yaml.
Serve apex apps (this site) next to tunnel subdomains from one engine — same pattern as 0Trust product edges.
Dashboard secured with passkeys and hardware-bound DBSC sessions via the 0Trust identity plane.
0 tunnels registered · control at tunnel.tunneltug.com
Browser ──HTTPS / HTTP3──► Product edge (:443) │ ┌──────────────┴──────────────┐ │ apex / www │ myapp.tunneltug.com ▼ ▼ Dashboard (:3082) TunnelTug LB QUIC :9000 · HTTP :8444 │ Server barge(s) process or k3s StatefulSet snapshots → reconnect │ Yamux ▼ Tunnel Client → Local App :3000
Clone the engine, build the binary, and grab a subdomain + token from the dashboard.
github.com/TunnelTug/tunneltugtunneltug -mode client \\ -server tunnel.tunneltug.com \\ -domain tunneltug.com \\ -subdomain myapp \\ -local 3000 \\ -token \"\"
Visit https://myapp.tunneltug.com after the client connects. Full docs →