- Add a new Tailscale-based private tunneling workflow using loopback-bound server + SSH local forwarding - Include usage examples for web and desktop clients over the local forwarded endpoint - Note fragment-style URL tokens to reduce exposure in request logs/history
Unified · Split
| @@ -38,6 +38,36 @@ ssh -L 3773:127.0.0.1:3773 <user>@<remote-host> · 37 unmodified lines | ||
| 38 | 38 | |
| 39 | 39 | Then connect clients to `ws://127.0.0.1:3773` with the same token. |
| 40 | 40 | |
| 41 | +### 1b) Private Tunnel With Tailscale (no public exposure) | |
| 42 | +This keeps your T3 server private to your tailnet and avoids opening router/firewall ports to the public internet. | |
| 43 | + | |
| 44 | +1. Install and log in to Tailscale on both machines. | |
| 45 | +2. Verify the two machines can reach each other over tailnet: | |
| 46 | +```bash | |
| 47 | +tailscale status | |
| 48 | +``` | |
| 49 | +3. On the remote machine, run T3 loopback-only: | |
| 50 | +```bash | |
| 51 | +T3CODE_HOST=127.0.0.1 T3CODE_PORT=3773 T3CODE_AUTH_TOKEN=<token> bun run start | |
| 52 | +``` | |
| 53 | +4. From your client machine, create an SSH local-forward over Tailscale: | |
| 54 | +```bash | |
| 55 | +ssh -N -L 3773:127.0.0.1:3773 <user>@<remote-tailnet-name-or-100.x.y.z> | |
| 56 | +``` | |
| 57 | + | |
| 58 | +Now your local machine has a private tunnel at `127.0.0.1:3773` to the remote T3 server. | |
| 59 | + | |
| 60 | +Use clients exactly like local: | |
| 61 | +- Web: `http://localhost:<web-port>/?t3WsUrl=ws://127.0.0.1:3773&t3Token=<token>` | |
| 62 | +- Desktop: | |
| 63 | +```bash | |
| 64 | +T3CODE_REMOTE_WS_URL=ws://127.0.0.1:3773 T3CODE_REMOTE_WS_TOKEN=<token> bun run start:desktop | |
| 65 | +``` | |
| 66 | + | |
| 67 | +Notes: | |
| 68 | +- If you use Tailscale SSH, the same `ssh -L` pattern works. | |
| 69 | +- This model does not expose T3 to the public internet; access is limited by your tailnet + SSH auth + T3 token. | |
| 70 | + | |
| 41 | 71 | ### 2) Direct Authenticated WS |
| 42 | 72 | Run remote server network-bound: |
| 43 | 73 | ```bash |
| @@ -62,6 +92,7 @@ https://api.example.com/?t3Token=secret · 18 unmodified lines | ||
| 62 | 92 | Notes: |
| 63 | 93 | - If `t3WsUrl` is `http://` or `https://`, it is normalized to `ws://` or `wss://`. |
| 64 | 94 | - If no URL is provided, web falls back to same-origin WS using page protocol. |
| 95 | +- To avoid putting tokens in request logs/history, prefer fragment form (supported): `#t3WsUrl=...&t3Token=...` | |
| 65 | 96 | |
| 66 | 97 | ### Desktop App |
| 67 | 98 | Set remote mode env vars before launch: |