Secure reverse tunnels
Run a lightweight agent next to your service — it dials out over QUIC, so there are no ports to open — and Tuyau hands it a public HTTPS endpoint, with certificates issued automatically.
# point the agent at your local service tuyau client --server tuyau.brumal.dev:443 \ --token <token> --ingress app=127.0.0.1:8080 # → https://<slug>.tuyau.brumal.dev is live
The agent dials out over QUIC, so there is nothing inbound to expose. It works behind NAT and firewalls, no port-forwarding.
Every hostname gets its own Let's Encrypt certificate, issued on demand the moment you provision it and renewed for you.
In passthrough mode the tunnel forwards encrypted bytes it never decrypts — your service terminates TLS, end to end.
Run several agents for one hostname and traffic round-robins across them. Restart or deploy one without dropping the route.
Routing is by SNI on a single port, so any TLS service fits behind the same tunnel — not just web apps.
Expose Postgres, Redis, Kafka or MQTT by hostname — same single port, your own end-to-end encryption.
Reach a private Kubernetes API, Vault or registry by hostname, with mutual TLS passed through untouched.
Running over QUIC, the tunnel migrates across IP changes — Wi-Fi to LTE — instead of dropping.
Start an agent and get a public HTTPS URL for your local service in seconds.
Get started