Bohdan Triapitsyn
2031e3b4a8
Add a packaged-client runtime boundary so the shared UI can talk to local, desktop, remote, and VS Code runtimes through the right transport instead of assuming one same-origin web server. Centralize OpenChamber-owned API access behind RuntimeAPIs, runtimeFetch, and runtime URL helpers, while keeping official OpenCode traffic on the SDK path. Support runtime switching, remote host selection, desktop client credentials, and headless connection links for pairing packaged clients with remote OpenChamber servers. Harden the new auth model by moving long-lived client tokens out of browser URLs, introducing short-lived scoped URL tokens for browser-owned transports, restricting URL-token access to explicit readable/realtime routes, and making client-token management session-scoped or self-scoped as appropriate. Update browser-owned assets and preview proxy flows to work with the split runtime model, including authenticated project icons, preview token propagation, CSP-safe preview bridge injection, and preview proxy auth that survives short-lived URL-token expiry. Tighten Electron security boundaries for packaged clients by gating privileged preload state to trusted origins and requiring explicit confirmation before connect deep-links import or switch remote runtimes. Also refresh agent guidance and project skills so future runtime/API, auth, preview, UI, CLI, settings, locale, and drag-to-reorder work follows the new architecture.
117 lines
3.1 KiB
Plaintext
117 lines
3.1 KiB
Plaintext
---
|
||
title: 隧道
|
||
description: 安全地将 OpenChamber 开放给远程和移动访问。
|
||
---
|
||
|
||
# 隧道
|
||
|
||
隧道是指向你的 OpenChamber 的一个公开链接，让你可以从手机或另一个网络访问它。使用 `openchamber tunnel` 为正在运行的实例创建一个隧道。
|
||
|
||
## 前置要求
|
||
|
||
OpenChamber 会在你的机器上启动隧道提供商的 CLI。请先安装你想使用的提供商：
|
||
|
||
```bash
|
||
brew install cloudflared
|
||
brew install ngrok
|
||
```
|
||
|
||
Cloudflare 快速隧道可以通过 `cloudflared` 运行。Ngrok 需要 ngrok 账号，以及从 ngrok dashboard 获取的 authtoken：
|
||
|
||
```bash
|
||
ngrok config add-authtoken <your-ngrok-token>
|
||
```
|
||
|
||
## 快速开始
|
||
|
||
1. 启动 OpenChamber：
|
||
|
||
```bash
|
||
openchamber
|
||
```
|
||
|
||
如果跳过这一步，`openchamber tunnel start` 可以自动启动 CLI 服务器。自动启动时可以传入服务器选项，例如 `--port`、`--host`、`--lan`、`--ui-password` 和 `--api-only`。
|
||
|
||
2. 启动 Cloudflare 隧道：
|
||
|
||
```bash
|
||
openchamber tunnel start --provider cloudflare --mode quick
|
||
```
|
||
|
||
或启动 Ngrok 隧道：
|
||
|
||
```bash
|
||
openchamber tunnel start --provider ngrok --mode quick
|
||
```
|
||
|
||
3. 查看状态：
|
||
|
||
```bash
|
||
openchamber tunnel status
|
||
```
|
||
|
||
隧道建立后，`status` 会显示一个公开 URL。打开它，或扫描二维码，即可从任何地方访问 OpenChamber。
|
||
|
||
默认情况下，OpenChamber 会在交互式 TTY 会话中输出二维码。使用 `--qr` 强制输出二维码，或使用 `--no-qr` 将其禁用。
|
||
|
||
## 提供商
|
||
|
||
- `cloudflare`：quick、managed remote 和 managed local 模式
|
||
- `ngrok`：quick 模式
|
||
|
||
## 托管模式
|
||
|
||
### 托管远程
|
||
|
||
使用由 Cloudflare 托管的令牌 + 主机名：
|
||
|
||
```bash
|
||
openchamber tunnel start --provider cloudflare --mode managed-remote --token-file ~/.secrets/cf-token --hostname app.example.com
|
||
```
|
||
|
||
### 托管本地
|
||
|
||
使用本地的 `cloudflared` 配置：
|
||
|
||
```bash
|
||
openchamber tunnel start --provider cloudflare --mode managed-local --config ~/.cloudflared/config.yml
|
||
```
|
||
|
||
## 配置文件（managed-remote）
|
||
|
||
保存一个可重用的配置文件：
|
||
|
||
```bash
|
||
openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token-file ~/.secrets/cf-token
|
||
```
|
||
|
||
使用已保存的配置文件启动：
|
||
|
||
```bash
|
||
openchamber tunnel start --profile prod-main
|
||
```
|
||
|
||
## 实用命令
|
||
|
||
```bash
|
||
openchamber tunnel providers
|
||
openchamber tunnel ready --provider cloudflare
|
||
openchamber tunnel ready --provider ngrok
|
||
openchamber tunnel doctor --provider cloudflare
|
||
openchamber tunnel doctor --provider ngrok
|
||
openchamber tunnel stop --port 3000
|
||
```
|
||
|
||
## 行为说明
|
||
|
||
- 每个 OpenChamber 实例（端口）只有一个活动隧道
|
||
- 在同一实例上启动新的模式/提供商会替换之前的隧道
|
||
- 生成新的连接链接会吊销之前未使用的链接
|
||
|
||
## 相关内容
|
||
|
||
- [安全](/zh-cn/security/) — 在开放访问前保护 UI
|
||
- [桌面端隧道](/zh-cn/desktop-tunnels/) — 无需从 CLI 启动即可在桌面应用中设置隧道
|
||
- [PWA 与移动访问](/zh-cn/mobile/) — 从手机访问 OpenChamber
|
||
- [问题排查](/zh-cn/troubleshooting/) — 如果隧道链接无法使用
|