No description
  • TypeScript 71.5%
  • Go 27.1%
  • JavaScript 1.4%
Find a file
BetterTunnels Bot acd0a3b70e
fix(auth): bind sessions to trusted IP ranges
Reject bearer tokens used outside a trusted hashed network range. Require
browser re-authentication before enrolling a new range. Trusted ranges
expire after one year of inactivity.

Includes the ClientTrustedIpRange database migration and lets tunnel
creators bypass visitor verification from their exact originating IP.
2026-07-24 01:26:04 +02:00
.github/workflows fix(release): build npm package 2026-07-12 22:06:57 +02:00
cli fix(auth): bind sessions to trusted IP ranges 2026-07-24 01:26:04 +02:00
logos feat: add BetterPortal auth flow 2026-07-01 20:27:35 +02:00
prisma fix(auth): bind sessions to trusted IP ranges 2026-07-24 01:26:04 +02:00
scripts feat: publish tunnel service plugins 2026-07-01 23:58:55 +02:00
src fix(auth): bind sessions to trusted IP ranges 2026-07-24 01:26:04 +02:00
tests fix(auth): bind sessions to trusted IP ranges 2026-07-24 01:26:04 +02:00
.dockerignore Initial BetterTunnels implementation 2026-07-01 00:52:56 +02:00
.env.example Initial BetterTunnels implementation 2026-07-01 00:52:56 +02:00
.gitignore feat(cli): service orchestration, stable reconnect URLs 2026-07-07 12:14:49 +02:00
betterportal-logo.png fix: publish tunnels admin plugin metadata 2026-07-01 21:30:43 +02:00
bsb-plugin.json feat: publish tunnel service plugins 2026-07-01 23:58:55 +02:00
Caddyfile fix(caddy): branded auto-retry error page when app upstream is down 2026-07-07 12:47:06 +02:00
docker-compose.yml fix(deploy): require postgres password env 2026-07-02 00:40:30 +02:00
docker-stack.yml fix(deploy): require postgres password env 2026-07-02 00:40:30 +02:00
Dockerfile.caddy Initial BetterTunnels implementation 2026-07-01 00:52:56 +02:00
package-lock.json build: update BetterPortal dependencies 2026-07-13 10:44:38 +02:00
package.json build: update BetterPortal dependencies 2026-07-13 10:44:38 +02:00
prisma.config.ts Initial BetterTunnels implementation 2026-07-01 00:52:56 +02:00
README.md feat: publish tunnel service plugins 2026-07-01 23:58:55 +02:00
sec-config.yaml fix: load database config from BSB 2026-07-02 00:24:35 +02:00
SPEC.md fix(auth): bind sessions to trusted IP ranges 2026-07-24 01:26:04 +02:00
tsconfig.json Initial BetterTunnels implementation 2026-07-01 00:52:56 +02:00

BetterTunnels

HTTP/HTTPS development tunnels using BSB, H3, AnyVali, websocket clients, Prisma, and PostgreSQL 18.

Dev Setup

npm install
copy .env.example .env
npm run prisma:generate
npm run build

Start PostgreSQL 18 with the included compose file when Docker is available:

docker compose up -d postgres
npm run prisma:migrate

Run the server:

npm run dev

Server startup goes through BSB. Do not start a standalone src/server.ts.

Run a tunnel:

npm run cli -- http 3300

Build the release CLI:

cd cli
go build -o ..\dist\btunnel.exe .

Notes

  • Default domain: tunnels.betterportal.dev.
  • Anonymous configured prefixes are ignored.
  • Authenticated prefix handling is designed but auth is not in the first runtime slice.
  • The H3/WS runtime is owned by the service-tunnels-proxy BSB plugin.
  • The release CLI lives in cli/ and builds to single-file Go binaries for Windows, Linux, and macOS.

Docker

Build the BSB runtime image with this plugin preloaded:

docker build -t better-tunnels:dev .

Run it with a production DATABASE_URL:

docker run --rm -p 8080:8080 -p 8081:8081 -e DATABASE_URL="postgresql://..." better-tunnels:dev

Swarm Deploy

On the server, build local images, run migrations, then deploy the stack:

docker swarm init
docker build -t bettertunnels-app:latest .
docker build -t bettertunnels-migrate:latest --target build .
docker build -t bettertunnels-caddy:latest -f Dockerfile.caddy .
docker stack deploy -c docker-stack.yml bettertunnels

app runs two replicas with start-first rolling updates. Caddy and Postgres are singletons on this one-node swarm. The stack reuses the original Compose volumes by external name.