Tunnel-Me (TM)

Just another tunneling software, similar to

• ngrok
• Cloudflare tunnels
• and dozens of other...

Whether it's better or worse than the others is up to you to decide, though some highlights to mention:

• exposes a single port
• HTTP(S)/WS(S) in and out - works behind practically any reverse proxies
• SSO via OIDC - included for free forever
• Simplest possible installation
  • single binary for both server and agent
  • official Docker images for most major platforms
• Zero external runtime dependencies (air-gap/onprem friendly - no "call home")
• Reliable in terms of networking - boring websocket, reasonable retries and timeouts
• API first - automate as you wish

It's NOT the best in terms of

• fastest: KCP or similar has no HTTP overhead but requires non-standard protocols (and ports) and poor support in reverse proxies
• FAANG/MANGA-scale: it intentionally keeps focus on simple deployment - sqlite, single binary, in-memory cache.

The catch: the server itself needs a host with a public address - any cheap low-end VPS with a single open port will do.

How it fits together:

flowchart LR
    visitor(["Visitor"]) -->|"myapp.tunnels.example.com"| server["Server<br/>public host, one port"]
    you(["You"]) -->|"admin panel"| server
    server <-->|"always-on tunnel<br/>(agent dials out)"| agent["Agent<br/>your home machine"]
    agent -->|"localhost:3000"| service(["Your service"])

Installation

The absolute minimum — a throwaway instance on localhost. No login by default (fine for the laptop, not for the internet):

docker run --rm -p 8080:8080 ghcr.io/reddec/tunnel-me

Open http://localhost:8080 for the admin panel; Ctrl-C stops the container and wipes everything.

The short version — on a public host with Docker:

docker run -d --name tunnel-me -p 8080:8080 -v ./data:/data \
  ghcr.io/reddec/tunnel-me serve \
  --domain tunnels.example.com \
  --public-url http://tunnels.example.com:8080 \
  --db /data/tunnel.db \
  --auth basic \
  --auth.basic.username me \
  --auth.basic.password change-me

The full walk-through, from DNS records to a running tunnel: Getting started.

Documentation

Start at tunnel-me.reddec.net — what tunnel-me is for, how it works, and a map to the guides: server, agent, authentication, reverse proxy, troubleshooting.

Screenshots

The admin panel — your agents at a glance:

Every agent keeps live stats — speed, ping, and connected clients:

Who is dialing in right now, and how much went through:

LLM

The backend is 90% handwritten (and therefore somewhat ugly), then polished via linter and LLM. Frontend, however, 99.98% vibe coded, since, while I might not be bad at design or frontend either, I found it hard to switch context between backend (where security matters) and UI, so I honestly delegated UI to LLMs.

Documentation - 50/50: navigated by me, written by AI.

No proprietary LLMs were used, intentionally, at the moment of first public release. A mix of Z.AI GLM and Deepseek models was used.

This project accepts human verified LLM PRs. However, it's the human's responsibility to answer maintainers' questions and ensure that PRs are small, scoped, atomic and well written. This project prefers a "boring" implementation - straightforward as hell.

License

GPL-3.0 - see LICENSE.