Internal tool courage to innovate
Nubeo Engineering // Internal // v0.10.4

Expose any port,anywhere.

tunnelctl is the in-house tunneling daemon for Nubeo developers. Drop an encrypted public endpoint — HTTP, TCP, or UDP — on top of any localhost service in under 200 ms. Share with the team, hit it from a phone, get the QA crew unblocked. Zero accounts. Zero config. Free for the whole org.

▶ Install Read the docs >
Free for Nubeo Self-hosted on Pi-blade cluster Single binary
— tunnelctl :: session 0xC0DE —
grid@nubeo ~ $  tunnelctl up http esigno-dev localhost:5173 ▌ tunnelctl :: forging encrypted tunnel... ✓ handshake tls 1.3 / chacha20-poly1305 ✓ edge node prg-01.intunnel.eu ✓ slug bound esigno-dev → public https://esigno-dev.intunnel.eu → local http://localhost:5173 ──── live traffic ────────────────────────────
14:22:01 200 GET /api/users 42ms 14:22:02 200 POST /api/login 118ms 14:22:03 404 GET /favicon.ico 3ms 14:22:04 200 GET /api/users/42 29ms
grid@nubeo ~ $ 
Latency p99
38 ms
Edge
prg-01.eu
Uptime
99.9%
200ms
Cold start
€0
Cost / dev
∞
Tunnels / dev
0
Config files
01 /
What it does today

Tiny scope. Honest tooling.

tunnelctl deliberately ships less than ngrok. No paid plans, no feature creep — just the one job done well. Spin up an HTTP, TCP, or UDP tunnel against a localhost port, share the endpoint, ship the demo. Anything fancier we add only when an actual Nubeo project asks for it.

// CORE

Instant Tunnels

One command spins up a TLS-terminated tunnel pointing at any local port. No signup, no DNS, no waiting. Ship a working URL before your coffee finishes brewing.

// DNS

Pick Your Subdomain

You choose the slug — every HTTP tunnel lives at <slug>.intunnel.eu. The same name across restarts means stable URLs for QA, webhook callbacks, and shared previews.

// L4

TCP & UDP, too

Not just HTTP. tunnelctl up tcp exposes Postgres, Redis, SSH, MQTT — anything that talks bytes. up udp handles DNS, QUIC, game servers. Ports come from a shared pool at tcp.intunnel.eu / udp.intunnel.eu.

// SEC

End-to-end Encryption

TLS 1.3 with ChaCha20-Poly1305 between client and edge on HTTP. Optional basic-auth gate or IP allowlist if you're exposing a staging build to a vendor.

// SHIP

Single Binary

One static binary. No Docker, no systemd hoops, no language runtime. macOS (Intel + Apple Silicon), Linux x86_64 / arm64, Windows. Just drop it in your $PATH.

02 /
Power-up sequence

Three commands to go live.

Install once. Authenticate against your Nubeo SSO once. Tunnel forever. The full reference — every flag, every config knob, every edge case — lives at docs.tunnelctl.eu.

LEVEL 01

Install

Single binary, zero deps. Pick your distro in the hero — the snippet below switches with it. Same data, just annotated for context.

# Add the tunnelctl Homebrew tap (one-time setup):
$ brew tap tunnelctl/tunnelctl https://git.piblade.net/tunnelctl/homebrew-tunnelctl.git
# Install the CLI:
$ brew install tunnelctl
LEVEL 02

Auth

SSO via Nubeo's identity provider. tunnelctl login auto-detects the right flow — PKCE in the browser on a desktop, OAuth device grant on a headless box. Override with --auth-flow when you need to.

# Desktop: opens the browser to your identity provider.
$ tunnelctl login
→ opening browser...
✓ logged in as you@nubeo.eu
# SSH / CI / container — no local browser:
$ tunnelctl login --auth-flow=device
→ visit https://id.nubeo.io/device, code: ABCD-1234
LEVEL 03

Tunnel

Pick a protocol — http, tcp, or udp — and go. HTTP tunnels live at <slug>.intunnel.eu; raw L4 lands on a port from the shared pool. -d backgrounds it.

# HTTP tunnel — slug + local target:
$ tunnelctl up http myapp 8080
→ https://myapp.intunnel.eu
# Vite / webpack dev servers: rewrite Host header:
$ tunnelctl up http web localhost:5173 --host-header-rewrite=localhost -d
# Raw TCP (Postgres, Redis, custom protocols):
$ tunnelctl up tcp 27017 5432
→ tcp.intunnel.eu:27017
03 /
Patch notes & roadmap

What ships. What doesn't (yet).

We're being upfront about scope. Below is what's in the box right now and what's on the backlog. If something on the right side blocks your work, file an issue at track.nubeo.eu and we'll bump it.

v0.10 — Shipped
STABLE
  • HTTP, TCP, and UDP tunnels
    protocol picked by subcommand — up http, up tcp, up udp
  • HTTPS slugs on <slug>.intunnel.eu
    you pick the name; same slug across restarts
  • Raw L4 at tcp.intunnel.eu:<port>
    TCP/UDP grab a port from a shared pool — Postgres, Redis, SSH, DNS, QUIC
  • slugs check + ports helpers
    validate a slug before binding; inspect / pick from the server's port range
  • status --all cross-host roster
    see every tunnel you've reserved, on any host — replaces the removed tunnels list
  • Foreground by default, -d to detach
    Ctrl+C tears the tunnel down cleanly; daemon mode is opt-in for long-running jobs
  • --auth-flow family
    auto / PKCE / device — RFC 8628 device grant for headless boxes, CI, SSH sessions
  • Host header rewrite
    --host-header-rewrite for dev servers that strict-match the Host header (Vite, webpack-dev-server)
  • TLS 1.3 + basic auth + IP allowlist
    ChaCha20-Poly1305 between client and edge; optional gates on HTTP tunnels
  • Single static binary, multi-arch
    macOS / Linux / Windows
Backlog
NOT YET
  • Auto-suggested slugs
    slug is mandatory today — no random fallback for quick one-shots
  • Custom domains
    currently only *.intunnel.eu — no api.acme.dev yet
  • Traffic inspector
    no built-in request replay UI for now
  • Webhook replay & persistence
    tunnels are ephemeral; replay is on the backlog
  • Load balancing across clients
    one tunnel, one client — round-robin not implemented
  • Multi-region edge
    single edge in Prague (prg-01) for now

Ready Player One?

Drop a public URL on top of localhost in the next 30 seconds. No credit card. No marketing email. No quota. Just a daemon and a glowing terminal — courtesy of Nubeo Engineering.

$ brew tap tunnelctl/tunnelctl https://git.piblade.net/tunnelctl/homebrew-tunnelctl.git
$ brew install tunnelctl