Container registry · public pull · signed pushes · config builder

TunnelTug Hub

A private registry for TunnelTug and 0Trust services. Pull images without signing in. Push only with a secret from your dashboard. Open Configure on any card for YAML + Tugconf (scale, link services, multi-instance). Artifacts live on the 0trust.social content network.

https://hub.tunneltug.com
Registry host
Anyone / operators
Pull / Push
0trust.social
Object storage
Signed digests
Release integrity

Images

Each service ships as a container. Click Configure for site YAML + Tugconf (scale, link, multi-instance).

🌊

Williwaw

Social feeds and stories for communities

hub.tunneltug.com/0trust/williwaw:latest
appZero Config Port: 3081
LicenseMITSignaturenot published
📝

MotionKB

Documentation and published sites

hub.tunneltug.com/0trust/motionkb:latest
appZero Config Port: 8090
LicenseMITSignaturenot published
🎙️

Ack

Event and community chat

hub.tunneltug.com/0trust/ack:latest
appZero Config Port: 3083
LicenseMITSignaturenot published
✉️

MeshMail

Secure team email

hub.tunneltug.com/0trust/mail:latest
appZero Config Port: 3086
LicenseMITSignaturenot published
🔍

MeshSearch

Private search for your mesh

hub.tunneltug.com/0trust/search:latest
appZero Config Port: 3087
LicenseMITSignaturenot published
⬡

GitMesh

GitHub replacement — go-git source hosting on the mesh

hub.tunneltug.com/0trust/gitmesh:latest
appZero Config Port: 3088
LicenseMITSignaturenot published
📁

0Trust Drive

Private cloud files — folders, previews, CRDT multi-device sync

hub.tunneltug.com/0trust/drive:latest
appZero Config Port: 3095
LicenseMITSignaturenot published
🛡️

0Trust Platform

Full identity and control plane

hub.tunneltug.com/0trust/platform:latest
appZero Config Port: 8443
LicenseMITSignaturenot published
🕸️

0Trust Services

Mesh access and edge agents

hub.tunneltug.com/0trust/services:latest
appZero Config Port: 8080
LicenseMITSignaturenot published
📦

0Trust CDN

Media and object delivery

hub.tunneltug.com/0trust/social:latest
appZero Config Port: 3085
LicenseMITSignaturenot published
🌐

0Trust Name (gTLD)

Public gTLD face — DoH, RDAP, registrar brand

hub.tunneltug.com/0trust/name:latest
infraZero Config Port: 8447
LicenseMITSignaturenot published
🔐

DBSC Relay

Device-bound session credential relay

hub.tunneltug.com/0trust/dbsc-relay:latest
infraZero Config Port: 8450
LicenseMITSignaturenot published
📡

Anycast edge

Multi-region DNS and BGP anycast

hub.tunneltug.com/0trust/anycast:latest
infraZero Config Port: 9099
LicenseMITSignaturenot published
🌺

Orchid Sync Ingest

Log and event ingest with orchid_sync BM25

hub.tunneltug.com/0trust/orchid-ingest:latest
infraZero Config Port: 8451
LicenseMITSignaturenot published
🔑

0Trust Auth

Identity provider — OIDC, passkeys, sessions

hub.tunneltug.com/0trust/auth:latest
platformZero Config Port: 8460
LicenseMITSignaturenot published
👥

0Trust IAM

Users, roles, and admin IAM console

hub.tunneltug.com/0trust/iam:latest
platformZero Config Port: 8461
LicenseMITSignaturenot published
🚪

0Trust Access

ZTNA app access gateway

hub.tunneltug.com/0trust/access:latest
platformZero Config Port: 8462
LicenseMITSignaturenot published
🔄

0Trust SCIM

SCIM provisioning plane

hub.tunneltug.com/0trust/scim:latest
platformZero Config Port: 8463
LicenseMITSignaturenot published
📜

0Trust PKI

Mesh CA and certificate issuance

hub.tunneltug.com/0trust/pki:latest
platformZero Config Port: 8464
LicenseMITSignaturenot published
⚙️

0Trust Workflows

Automation pipelines and cron

hub.tunneltug.com/0trust/workflows:latest
platformZero Config Port: 8465
LicenseMITSignaturenot published
🗺️

0Trust Topology

Fleet and network topology

hub.tunneltug.com/0trust/topology:latest
platformZero Config Port: 8466
LicenseMITSignaturenot published
📡

0Trust Name Service

Private DNS / nameservice admin

hub.tunneltug.com/0trust/nameservice:latest
platformZero Config Port: 8467
LicenseMITSignaturenot published
🗝️

0Trust Service Keys

Service API keys and fleet tokens

hub.tunneltug.com/0trust/servicekeys:latest
platformZero Config Port: 8468
LicenseMITSignaturenot published
🪪

0Trust VPI

VPI product identity plane

hub.tunneltug.com/0trust/vpi:latest
platformZero Config Port: 8469
LicenseMITSignaturenot published
📋

0Trust Logs

Log explorer and observability UI

hub.tunneltug.com/0trust/logs:latest
platformZero Config Port: 8470
LicenseMITSignaturenot published
🗄️

Ultimate DB (kernel replication)

Service data-replication peer — products keep local embeds and AddPeer /kernel/* (not prefer-remote)

hub.tunneltug.com/0trust/ultimate-db:latest
kernelZero Config Port: 8480
LicenseMITSignaturenot published
🔑

Ultimate Keystore (kernel replication)

Keystore replication peer via /kernel/keystore — local material stays primary

hub.tunneltug.com/0trust/ultimate-keystore:latest
kernelZero Config Port: 8481
LicenseMITSignaturenot published
🚢

TunnelTug engine

Runtime for tunnel fleets

hub.tunneltug.com/tunneltug/engine:latest
engineZero Config Port: —
LicenseMITSignaturenot published
Copied

Run a tunnel fleet

Registry

The fleet controller can host the registry, store blobs on 0trust.social, and serve public pulls.

Integrity

Each release records fleet settings and the exact image digest so you can detect unexpected image changes.

Capacity

Tunnel servers run from hub.tunneltug.com/tunneltug/engine:latest and register with your load balancer automatically.

export TUNNELTUG_TOKEN=\"$(tunneltug -gen-token)\"

tunneltug -mode barge -barge-runtime k3s \\
  -barge-replicas 2 \\
  -k3s-image hub.tunneltug.com/tunneltug/engine:latest \\
  -token \"$TUNNELTUG_TOKEN\" \\
  -domain tunneltug.com

Publish and deploy

Build images

export HUB_TAG=latest TUNNELTUG_TOKEN=…
./deploy/oci/build-and-publish.sh all

Publish only

tunneltug -mode hub-publish \\
  -hub-products all \\
  -hub-tag latest \\
  -token \"$TUNNELTUG_TOKEN\"

Site config / stack

tunneltug -config site.yaml -pop sfo -mode stack \\
  -token \"$TUNNELTUG_TOKEN\"

# or stack YAML only
tunneltug -mode stack -stack-config stack.yaml \\
  -token \"$TUNNELTUG_TOKEN\"

Dashboard Docs Architectures Registry API

License

All images on hub.tunneltug.com and the TunnelTug engine that serves them are open source under the MIT License. That includes the engine, apps, kernel replication barges, 0Trust Name (gTLD), platform feature barges (Auth, IAM, Access, SCIM, PKI, …), Orchid Sync Ingest, and more.

View LICENSE · Source