Bohdan Triapitsyn
7ea974d89b
- new Connect a Device page: one-time QR pairing, transport choices, device management - new Private Relay page: E2EE guarantees, demand-driven lifecycle, relay vs tunnel - rewrite mobile page around the native iOS/Android apps (TestFlight + APK) - update remote-instances, security, tunnels, and remote-access troubleshooting to point at the new pairing flow - translate everything across all 8 locales and update the sidebar
121 lines
3.4 KiB
Plaintext
121 lines
3.4 KiB
Plaintext
---
|
|
title: Tunnels
|
|
description: Expose OpenChamber safely for remote and mobile access.
|
|
---
|
|
|
|
# Tunnels
|
|
|
|
A tunnel is a public link to your OpenChamber, so you can reach it from an ordinary browser on another network. Use `openchamber tunnel` to create one for a running instance.
|
|
|
|
> Connecting your **own devices** (the mobile app, another desktop) usually doesn't need a tunnel — [pair them](/connect-devices/) instead and let the end-to-end encrypted [Private Relay](/private-relay/) handle away-from-home access with zero setup.
|
|
|
|
## Prerequisites
|
|
|
|
OpenChamber starts the tunnel provider CLI on your machine. Install the provider you want to use first:
|
|
|
|
```bash
|
|
brew install cloudflared
|
|
brew install ngrok
|
|
```
|
|
|
|
Cloudflare quick tunnels can run with `cloudflared`. Ngrok requires an ngrok account and an authtoken from the ngrok dashboard:
|
|
|
|
```bash
|
|
ngrok config add-authtoken <your-ngrok-token>
|
|
```
|
|
|
|
## Quick start
|
|
|
|
1. Start OpenChamber:
|
|
|
|
```bash
|
|
openchamber
|
|
```
|
|
|
|
If you skip this step, `openchamber tunnel start` can auto-start a CLI server. When auto-starting, you can pass server options such as `--port`, `--host`, `--lan`, `--ui-password`, and `--api-only`.
|
|
|
|
2. Start a Cloudflare tunnel:
|
|
|
|
```bash
|
|
openchamber tunnel start --provider cloudflare --mode quick
|
|
```
|
|
|
|
Or start an Ngrok tunnel:
|
|
|
|
```bash
|
|
openchamber tunnel start --provider ngrok --mode quick
|
|
```
|
|
|
|
3. Check status:
|
|
|
|
```bash
|
|
openchamber tunnel status
|
|
```
|
|
|
|
When the tunnel is up, `status` shows a public URL. Open it, or scan the QR code, to reach OpenChamber from anywhere.
|
|
|
|
By default, OpenChamber prints a QR code in interactive TTY sessions. Use `--qr` to force QR output, or `--no-qr` to disable it.
|
|
|
|
## Providers
|
|
|
|
- `cloudflare`: quick, managed remote, and managed local modes
|
|
- `ngrok`: quick mode
|
|
|
|
## Managed modes
|
|
|
|
### Managed remote
|
|
|
|
Use a token + hostname managed by Cloudflare:
|
|
|
|
```bash
|
|
openchamber tunnel start --provider cloudflare --mode managed-remote --token-file ~/.secrets/cf-token --hostname app.example.com
|
|
```
|
|
|
|
### Managed local
|
|
|
|
Use a local `cloudflared` config:
|
|
|
|
```bash
|
|
openchamber tunnel start --provider cloudflare --mode managed-local --config ~/.cloudflared/config.yml
|
|
```
|
|
|
|
## Profiles (managed-remote)
|
|
|
|
Save a reusable profile:
|
|
|
|
```bash
|
|
openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token-file ~/.secrets/cf-token
|
|
```
|
|
|
|
Start using the saved profile:
|
|
|
|
```bash
|
|
openchamber tunnel start --profile prod-main
|
|
```
|
|
|
|
## Useful commands
|
|
|
|
```bash
|
|
openchamber tunnel providers
|
|
openchamber tunnel ready --provider cloudflare
|
|
openchamber tunnel ready --provider ngrok
|
|
openchamber tunnel doctor --provider cloudflare
|
|
openchamber tunnel doctor --provider ngrok
|
|
openchamber tunnel stop --port 3000
|
|
```
|
|
|
|
## Behavior notes
|
|
|
|
- one active tunnel per OpenChamber instance (port)
|
|
- starting a new mode/provider on same instance replaces previous tunnel
|
|
- generating a new connect link revokes previous unused one
|
|
- tunnel auto-start preserves server flags like `--ui-password` and `--api-only` in the instance settings used by restart/update flows
|
|
|
|
## Related
|
|
|
|
- [Connect a Device](/connect-devices/) — pair your own devices without a public URL
|
|
- [Security](/security/) — protect the UI before exposing it
|
|
- [Desktop Tunnels](/desktop-tunnels/) — desktop app tunnel setup without CLI startup
|
|
- [PWA & Mobile](/mobile/) — reach OpenChamber from your phone
|
|
- [Troubleshooting](/troubleshooting/) — if the tunnel link doesn't work
|