Beyond HTTP

One tunnel. Any TCP service.

tuyau routes by the SNI in the TLS handshake, so a single port fronts every hostname — whatever protocol runs on top. You choose how far it looks into the connection.

One capability, three modes

The only thing that changes is how deep tuyau reads — and who owns the certificate.

Passthrough  :  client --TLS--> tuyau (forward encrypted)      --TLS-->   backend   (backend owns TLS)
TLS offload  :  client --TLS--> tuyau (DECRYPTS, cert=you)      --cleartext--> backend  (backend has ZERO TLS) ✨
h2 → h1      :  client --TLS--> tuyau (decrypts + SPEAKS http) --h1-->    backend   (one parser per protocol)

Passthrough

tuyau reads only the SNI and forwards the encrypted bytes untouched. Your service terminates TLS — end to end, tuyau never sees your data.

Certificate: Your service
Backend TLS: Yes

TLS offload

tuyau presents a Let's Encrypt certificate it issues and renews for you, decrypts, and forwards the plaintext to your backend. Your service listens in cleartext — no TLS to configure, for any TCP protocol.

Certificate: tuyau (ACME)
Backend TLS: None

HTTP terminated

tuyau terminates HTTPS and HTTP/2 from the browser and proxies down to a plain HTTP/1.1 backend. Modern protocols at the edge, nothing to change behind.

Certificate: tuyau (ACME)
Backend TLS: None

What you can put behind it

HTTP terminated

Web apps & APIs

A public HTTPS URL for anything on localhost. HTTP/2 at the edge, your app stays plain HTTP/1.1 — certificates issued and renewed automatically.

TLS offload

Databases & brokers

Expose Postgres, Redis, Kafka, MQTT or MongoDB by hostname. tuyau handles the certificate; your service can listen in cleartext. One generic path — no per-protocol code.

Passthrough

Internal services

Reach a private Kubernetes API, Vault or registry by hostname. In passthrough the client certificate survives untouched — mutual TLS stays end to end.

Any mode

Survives network changes

The tunnel runs over QUIC, so a connection migrates across IP changes instead of dropping. Move from Wi-Fi to LTE, switch towers — long-lived sessions keep going.

How routing works

tuyau peeks at the SNI — the hostname sent in the clear at the very start of the TLS handshake, before any data flows. That is what lets a single :443 demultiplex every hostname behind it, whatever protocol runs on top.

The one requirement is implicit TLS: the connection must start with a TLS handshake. Protocols that begin in cleartext and upgrade later (STARTTLS — SMTP, IMAP, or Postgres' SSLRequest) carry no SNI at that point, so they need a dedicated route rather than SNI demultiplexing.

Put something behind it

Start an agent and get a public endpoint for your local service in seconds.

Get started