Expose local HTTP services through a QUIC control tunnel and streaming HTTPS/HTTP/3 ingress. Scale with load-balanced barges, join the 0Trust mesh, or co-host product apexes with built-in vhosts.
LB mode assigns subdomains to backends (sticky or round-robin). Barge fleets auto-register and scale out without rewiring clients.
Clients dial tunnel.tunneltug.com over UDP with TLS (ALPN: tunneltug). Yamux multiplexes many concurrent streams per tunnel.
Ingress tuned for SSE and WebSockets over HTTPS and HTTP/3 — not just short request/response.
Multi-tenant host routing — myapp.tunneltug.com points at your local :3000. Optional namespaces for fleet isolation.
Register as myapp.tunneltug.tunnel and resolve .mesh / .social / .tunnel locally with the built-in VPI stub.
Serve apex apps (this site) next to tunnel subdomains from one engine config — same pattern as 0trust-services edges.
Production TLS via ACME on the edge; share cert cache across LB and vhost processes.
Dashboard secured with passkeys and hardware-bound DBSC sessions via the 0Trust identity plane.
Supervise multi-replica server fleets and namespace-aware orchestrator routing for multi-tenant ops.
0 tunnels registered · control at tunnel.tunneltug.com
Browser ──HTTPS / HTTP3──▶ Product edge (:443) │ ┌──────────────┴──────────────┐ │ apex / www │ myapp.tunneltug.com ▼ ▼ Dashboard (:3082) TunnelTug LB QUIC :9000 · HTTP :8444 │ Server barge(s) │ Yamux ▼ Tunnel Client ▼ Local App :3000
Clone the engine, build the binary, and grab a subdomain + token from the dashboard.
github.com/TunnelTugtunneltug -mode client \\ -server tunnel.tunneltug.com \\ -domain tunneltug.com \\ -subdomain myapp \\ -local 3000 \\ -token \"\"
Visit https://myapp.tunneltug.com after the client connects. Full docs →