joaoh82/rustunnel

The open-source tunnel that scales with you. Don't pay for idle time. Secure, Rust-fast, and Pay-as-you-go.
Expose local services through a public server over encrypted WebSocket connections with TLS termination, HTTP/TCP proxying, a live dashboard, Prometheus metrics, and audit logging.
You can self-host or use our managed service.
**Using an AI agent?** rustunnel ships an MCP server — one-click setup for Cursor (then add your API token):
For Claude Code, Claude Desktop, Windsurf, and others, see the agent integration guide or the agent manual at rustunnel.com/agents.md.
---
Table of Contents
- Hosted service
- Architecture overview
- Requirements
- Local development setup
- Build
- Run tests
- Run the server locally
- Run the client locally
- Git hooks
- Production deployment (Ubuntu / systemd)
- 1 — Install dependencies
- 2 — Build release binaries
- 3 — Create system user and directories
- 4 — Install the server binary
- 5 — Create the server config file
- 6 — TLS certificates (Let's Encrypt + Cloudflare)
- 7 — Set up systemd service
- 8 — Open firewall ports
- 9 — Verify the server is running
- Updating the server
- Docker deployment · full guide
- Client configuration
- Installation
- Setup wizard
- Quick start (CLI flags)
- Machine-readable output (--json)
- Config file
- Token management
- Port reference
- Config file reference (server)
- REST API
- AI agent integration (MCP server)
- OpenClaw skill
- Monitoring
- Roadmap
- Contributing
- License
- Contact
---
Hosted service
You can use rustunnel without running your own server. We operate a global fleet of public edge servers that you can connect to immediately.
Available regions
| Region ID | Server | Location | Control plane | Status |
|-----------|--------|----------|---------------|--------|
| eu | eu.edge.rustunnel.com | Helsinki, FI | :4040 | Live |
| us | us.edge.rustunnel.com | Hillsboro, OR | :4040 | Live |
| ap | ap.edge.rustunnel.com | Singapore | :4040 | Live |
The client auto-selects the nearest region by default. Use --region to connect to a specific one. The legacy address edge.rustunnel.com is a CNAME to eu.edge.rustunnel.com and will continue to work for backward compatibility.
Getting an auth token
Sign up for a free account at **rustunnel.com** — no waiting list, no manual approval.
1. Create an account at rustunnel.com
2. Go to **Dashboard → API Keys** and create a token
3. Copy the token — it is shown only once
**Plans:**
| Plan | Price | Tunnels | Custom subdomains | TLS/HTTPS |
|------|-------|---------|-------------------|-----------|
| Free | $0 | Up to 3 | — | ✓ |
| Pay-as-you-go | $3/mo minimum + $0.10/GB | Unlimited | ✓ | ✓ |
| Self-host | Free (run your own server) | Unlimited | ✓ | ✓ |
The free plan is a great way to get started. Upgrade to pay-as-you-go from your dashboard whenever you need custom subdomains or unlimited tunnels.
Quick start with the hosted server
Once you have a token, run the setup wizard:
Then expose a local service:
The client prints the public URL as soon as the tunnel is established:
---
Architecture overview
---
Requirements
To build
| Requirement | Version | Notes |
|---|---|---|
| Rust toolchain | 1.76+ | Install via rustup |
| pkg-config | any | Needed by reqwest (TLS) |
| libssl-dev | any | On Debian/Ubuntu: apt install libssl-dev |
| Node.js + npm | 18+ | Only needed to rebuild the dashboard UI |
To run the server in production
| Requirement | Notes |
|---|---|
| Linux (Ubuntu 22.04+) | systemd service included |
| TLS certificate + private key | PEM format (Let's Encrypt recommended) |
| Public IP / DNS | Wildcard DNS *.tunnel.yourdomain.com → server IP required for HTTP tunnels |
---
Local development setup
Build
Run tests
The integration test suite spins up a real server on random ports and exercises auth, HTTP tunnels, TCP tunnels, and reconnection logic. It requires a running PostgreSQL instance.
make db-start runs deploy/docker-compose.dev-deps.yml which starts a Postgres 16 container on localhost:5432. The make test target injects TEST_DATABASE_URL automatically. If you run cargo test directly, export the variable first:
Run the server locally
Generate a self-signed certificate for local testing:
A ready-made local config is checked into the repository at **deploy/local/server.toml**.
It points to the self-signed cert paths above and has auth disabled for convenience.
Start the server with it directly:
Key settings in deploy/local/server.toml:
| Setting | Value |
|---|---|
| Domain | localhost |
| HTTP edge | :8080 |