TunnelTug is public haul — developer tunnels, fleets, anycast, and multi-PoP product stacks with kernel replication. QUIC and HTTP/3 end to end. Private mesh L3 is not TunnelTug: use 0RTT-DBSC VPN on vpn.0trust.services, with the 0TrustOS sidecar for policy and provision (no open control port).
Run a client on your machine. Share a public HTTP/3 URL for demos, webhooks, mobile testing, and pair programming, without punching holes in your network.
Grow into load-balanced tunnel barges on k3s. Rolling updates keep capacity online while you ship. Snapshots restore tunnel inventory after restarts.
Geo-distributed anycast: health-gated BGP, split-horizon DNS, and multi-region ingress. Same product model, production footprint.
Multi-PoP stacks keep local embeds for speed. Kernel replication peers stream service data across regions — scale ingress, not a single remote DB.
Point a client at your local port and open myapp.tunneltug.com. Ideal from first demo through production cutover.
A QUIC control channel and streaming-friendly HTTP/3 keep long-lived connections, uploads, SSE, and WebSockets working the way you expect.
Public edges speak HTTP/3 where available, with automatic certificates in production so you spend time on the app, not TLS plumbing.
Add capacity behind a load balancer. Tunnel servers register themselves; traffic spreads across the fleet as demand grows.
Tunnel engines and product barges as managed k3s fleets. Stack YAML or site config — no kubectl required.
Multi-region production ingress with health-gated BGP announce and withdraw. When a PoP is unhealthy, traffic shifts with no manual DNS surgery.
Describe multi-PoP sites in YAML or Junos-like set language. One -config file wires domain, stack, anycast, and kernel peers.
ultimate_db / keystore barges are replication peers. Products keep local embeds; AddPeer for live sync across global ingresses.
Publish and pull images from hub.tunneltug.com. Public pull; authenticated push. Config builder on each catalog card.
Fleet configurations and image digests are cryptographically bound so you can confirm capacity is running the build you intended.
The dashboard uses 0Trust identity with passkeys and device-bound sessions. Tunnel secrets are generated for you, never pasted in by hand.
HA barge fleets, global anycast + multi-PoP mesh, vhost failover, and image integrity patterns — see Architectures.
Policy and provision on the node. Mesh enforcement without publishing a control port — orthogonal to public haul.
Provider L3 VPN: dial-only PoPs, DBSC tickets, SDF grants. Not TunnelTug — see the open design spec.
1 tunnels registered · public haul edge
Three planes stay separate by design. TunnelTug never becomes the VPN path; 0TrustOS never requires you to expose a control port for mesh enforcement.
Developer tunnels, fleets, anycast, hub images. Customer apps on the internet. No port punch for VPN clients.
gonode on Linux: policy, provision, operator. Enforce grants across the mesh without an open control listener.
vpn.0trust.services control · clients dial PoPs · WebAuthn + DBSC 0-RTT. Spec: 0TrustCloud/0rtt_dbsc_vpn_spec.
Visitors hit a public HTTP/3 edge. TunnelTug carries the request over a QUIC control tunnel to your laptop in development, or through fleets and anycast edges in production. Multi-PoP stacks replicate service data through the kernel mesh.
Public face on tunneltug.com · control at tunnel.tunneltug.com · images at hub.tunneltug.com · site config for multi-PoP · anycast when you need global ingress
Create an account, copy your tunnel secret from the dashboard, and pick a subdomain.
Open dashboardtunneltug -mode client \\ -server tunnel.tunneltug.com \\ -domain tunneltug.com \\ -subdomain myapp \\ -local 3000 \\ -token \"$TUNNELTUG_TOKEN\"
Then open https://myapp.tunneltug.com. Grow into fleets, site config, and anycast when you are ready. Read the docs → · Architectures → · Hub config builder →