TunnelTug is the public path for your product: start on a laptop, grow into load-balanced fleets, then land multi-region anycast and multi-PoP stacks — one model from first commit to production traffic.
Run a client beside your app. Expose a public face for webhooks, mobile clients, and integration work without redesigning how you ship later.
Add load-balanced tunnel capacity. Rolling updates keep ingress online. Snapshots restore inventory when capacity restarts.
Geo-distributed anycast and multi-region edges. Health-aware routing shifts traffic when a site is unhealthy.
Product stacks at the edge with local data and live kernel replication — scale global ingress without a single remote DB.
Dev client, fleets, and global anycast share one control model. You do not outgrow TunnelTug and start over for production.
Control over QUIC; public edges speak modern HTTP so long-lived streams, uploads, SSE, and WebSockets keep working.
Automatic certificates in production so operators spend time on the app and the fleet, not TLS plumbing.
Tunnel capacity registers itself behind a load balancer. Traffic spreads as you add servers.
Run tunnel engines and product barges as managed fleets. Stack YAML or site config — day-to-day without kubectl.
Multi-region announce and withdraw with health gates. Unhealthy PoPs step aside; clients keep the same hostname.
Describe multi-PoP sites in YAML or set language. One config wires domain, stack, anycast, and kernel peers.
Product stores peer across regions so each PoP stays local and warm — scale ingress, not a single remote database.
Publish and pull from hub.tunneltug.com. Public pull; authenticated push. Config builder on each catalog card.
Fleet configs and image digests are bound so you can verify production capacity is running the build you intended.
Dashboard sign-in via 0Trust identity and passkeys. Tunnel secrets are issued for you.
Fleet HA, multi-PoP mesh, vhost failover, and image integrity — see Architectures.
1 tunnels registered · public haul edge
Visitors hit a public HTTP/3 edge. TunnelTug carries traffic to your development machine, through a load-balanced fleet, or into multi-region anycast and product PoPs — same haul path, larger footprint.
Public face on tunneltug.com · control at tunnel.tunneltug.com · images at hub.tunneltug.com · site config for multi-PoP
Create an account, take a tunnel secret from the dashboard, and pick a subdomain for your first public face.
Open dashboardtunneltug -mode client \\ -server tunnel.tunneltug.com \\ -domain tunneltug.com \\ -subdomain myapp \\ -local 3000 \\ -token \"$TUNNELTUG_TOKEN\"
Open https://myapp.tunneltug.com, then grow into fleets, site config, and anycast when production needs global ingress. Read the docs → · Architectures → · Hub →