Container registry · public pull · signed pushes · config builder

TunnelTug Hub

A private registry for TunnelTug and 0Trust services. Pull images without signing in. Push only with a secret from your dashboard. Open Configure on any card for YAML + Tugconf (scale, link services, multi-instance). Artifacts live on the 0trust.social content network.

https://hub.tunneltug.com
Registry host
Anyone / operators
Pull / Push
0trust.social
Object storage
Signed digests
Release integrity

Images

Each service ships as a container. Click Configure for site YAML + Tugconf (scale, link, multi-instance).

🌊

Williwaw

Social feeds and stories for communities

hub.tunneltug.com/0trust/williwaw:latest
appZero Config Port: 3081
LicenseMITSignature
📝

MotionKB

Documentation and published sites

hub.tunneltug.com/0trust/motionkb:latest
appZero Config Port: 8090
LicenseMITSignature
🎙️

Ack

Event and community chat

hub.tunneltug.com/0trust/ack:latest
appZero Config Port: 3083
LicenseMITSignature
✉️

MeshMail

Secure team email

hub.tunneltug.com/0trust/mail:latest
appZero Config Port: 3086
LicenseMITSignature
🔍

MeshSearch

Private search for your mesh

hub.tunneltug.com/0trust/search:latest
appZero Config Port: 3087
LicenseMITSignature
⬡

GitMesh

GitHub replacement — go-git source hosting on the mesh

hub.tunneltug.com/0trust/gitmesh:latest
appZero Config Port: 3088
LicenseMITSignature
🛡️

0Trust Platform

Full identity and control plane

hub.tunneltug.com/0trust/platform:latest
appZero Config Port: 8443
LicenseMITSignature
🕸️

0Trust Services

Mesh access and edge agents

hub.tunneltug.com/0trust/services:latest
appZero Config Port: 8080
LicenseMITSignature
📦

0Trust CDN

Media and object delivery

hub.tunneltug.com/0trust/social:latest
appZero Config Port: 3085
LicenseMITSignature
🌐

0Trust Name (gTLD)

Public gTLD face — DoH, RDAP, registrar brand

hub.tunneltug.com/0trust/name:latest
infraZero Config Port: 8447
LicenseMITSignature
🔐

DBSC Relay

Device-bound session credential relay

hub.tunneltug.com/0trust/dbsc-relay:latest
infraZero Config Port: 8450
LicenseMITSignature
📡

Anycast edge

Multi-region DNS and BGP anycast

hub.tunneltug.com/0trust/anycast:latest
infraZero Config Port: 9099
LicenseMITSignature
🌺

Orchid Sync Ingest

Log and event ingest with orchid_sync BM25

hub.tunneltug.com/0trust/orchid-ingest:latest
infraZero Config Port: 8451
LicenseMITSignature
🔑

0Trust Auth

Identity provider — OIDC, passkeys, sessions

hub.tunneltug.com/0trust/auth:latest
platformZero Config Port: 8460
LicenseMITSignature
👥

0Trust IAM

Users, roles, and admin IAM console

hub.tunneltug.com/0trust/iam:latest
platformZero Config Port: 8461
LicenseMITSignature
🚪

0Trust Access

ZTNA app access gateway

hub.tunneltug.com/0trust/access:latest
platformZero Config Port: 8462
LicenseMITSignature
🔄

0Trust SCIM

SCIM provisioning plane

hub.tunneltug.com/0trust/scim:latest
platformZero Config Port: 8463
LicenseMITSignature
📜

0Trust PKI

Mesh CA and certificate issuance

hub.tunneltug.com/0trust/pki:latest
platformZero Config Port: 8464
LicenseMITSignature
⚙️

0Trust Workflows

Automation pipelines and cron

hub.tunneltug.com/0trust/workflows:latest
platformZero Config Port: 8465
LicenseMITSignature
🗺️

0Trust Topology

Fleet and network topology

hub.tunneltug.com/0trust/topology:latest
platformZero Config Port: 8466
LicenseMITSignature
📡

0Trust Name Service

Private DNS / nameservice admin

hub.tunneltug.com/0trust/nameservice:latest
platformZero Config Port: 8467
LicenseMITSignature
🗝️

0Trust Service Keys

Service API keys and fleet tokens

hub.tunneltug.com/0trust/servicekeys:latest
platformZero Config Port: 8468
LicenseMITSignature
🪪

0Trust VPI

VPI product identity plane

hub.tunneltug.com/0trust/vpi:latest
platformZero Config Port: 8469
LicenseMITSignature
📋

0Trust Logs

Log explorer and observability UI

hub.tunneltug.com/0trust/logs:latest
platformZero Config Port: 8470
LicenseMITSignature
🗄️

Ultimate DB (kernel replication)

Service data-replication peer — products keep local embeds and AddPeer /kernel/* (not prefer-remote)

hub.tunneltug.com/0trust/ultimate-db:latest
kernelZero Config Port: 8480
LicenseMITSignaturenot published
🔑

Ultimate Keystore (kernel replication)

Keystore replication peer via /kernel/keystore — local material stays primary

hub.tunneltug.com/0trust/ultimate-keystore:latest
kernelZero Config Port: 8481
LicenseMITSignaturenot published
🚢

TunnelTug engine

Runtime for tunnel fleets

hub.tunneltug.com/tunneltug/engine:latest
engineZero Config Port: —
LicenseMITSignature
Copied

Run a tunnel fleet

Registry

The fleet controller can host the registry, store blobs on 0trust.social, and serve public pulls.

Integrity

Each release records fleet settings and the exact image digest so you can detect unexpected image changes.

Capacity

Tunnel servers run from hub.tunneltug.com/tunneltug/engine:latest and register with your load balancer automatically.

export TUNNELTUG_TOKEN=\"$(tunneltug -gen-token)\"

tunneltug -mode barge -barge-runtime k3s \\
  -barge-replicas 2 \\
  -k3s-image hub.tunneltug.com/tunneltug/engine:latest \\
  -token \"$TUNNELTUG_TOKEN\" \\
  -domain tunneltug.com

Publish and deploy

Build images

export HUB_TAG=latest TUNNELTUG_TOKEN=…
./deploy/oci/build-and-publish.sh all

Publish only

tunneltug -mode hub-publish \\
  -hub-products all \\
  -hub-tag latest \\
  -token \"$TUNNELTUG_TOKEN\"

Site config / stack

tunneltug -config site.yaml -pop sfo -mode stack \\
  -token \"$TUNNELTUG_TOKEN\"

# or stack YAML only
tunneltug -mode stack -stack-config stack.yaml \\
  -token \"$TUNNELTUG_TOKEN\"

Dashboard Docs Architectures Registry API

License

All images on hub.tunneltug.com and the TunnelTug engine that serves them are open source under the MIT License. That includes the engine, apps, kernel replication barges, 0Trust Name (gTLD), platform feature barges (Auth, IAM, Access, SCIM, PKI, …), Orchid Sync Ingest, and more.

View LICENSE · Source