- Add a new Tailscale-based private tunneling workflow using loopback-bound server + SSH local forwarding - Include usage examples for web and desktop clients over the local forwarded endpoint - Note fragment-style URL tokens to reduce exposure in request logs/history
Unified · Split
| @@ -38,6 +38,36 @@ ssh -L 3773:127.0.0.1:3773 <user>@<remote-host> · 37 unmodified lines | |||
| 38 | 38 | ||
| 39 | Then connect clients to `ws://127.0.0.1:3773` with the same token. | 39 | Then connect clients to `ws://127.0.0.1:3773` with the same token. |
| 40 | 40 | ||
| 41 | ### 1b) Private Tunnel With Tailscale (no public exposure) | ||
| 42 | This keeps your T3 server private to your tailnet and avoids opening router/firewall ports to the public internet. | ||
| 43 | |||
| 44 | 1. Install and log in to Tailscale on both machines. | ||
| 45 | 2. Verify the two machines can reach each other over tailnet: | ||
| 46 | ```bash | ||
| 47 | tailscale status | ||
| 48 | ``` | ||
| 49 | 3. On the remote machine, run T3 loopback-only: | ||
| 50 | ```bash | ||
| 51 | T3CODE_HOST=127.0.0.1 T3CODE_PORT=3773 T3CODE_AUTH_TOKEN=<token> bun run start | ||
| 52 | ``` | ||
| 53 | 4. From your client machine, create an SSH local-forward over Tailscale: | ||
| 54 | ```bash | ||
| 55 | ssh -N -L 3773:127.0.0.1:3773 <user>@<remote-tailnet-name-or-100.x.y.z> | ||
| 56 | ``` | ||
| 57 | |||
| 58 | Now your local machine has a private tunnel at `127.0.0.1:3773` to the remote T3 server. | ||
| 59 | |||
| 60 | Use clients exactly like local: | ||
| 61 | - Web: `http://localhost:<web-port>/?t3WsUrl=ws://127.0.0.1:3773&t3Token=<token>` | ||
| 62 | - Desktop: | ||
| 63 | ```bash | ||
| 64 | T3CODE_REMOTE_WS_URL=ws://127.0.0.1:3773 T3CODE_REMOTE_WS_TOKEN=<token> bun run start:desktop | ||
| 65 | ``` | ||
| 66 | |||
| 67 | Notes: | ||
| 68 | - If you use Tailscale SSH, the same `ssh -L` pattern works. | ||
| 69 | - This model does not expose T3 to the public internet; access is limited by your tailnet + SSH auth + T3 token. | ||
| 70 | |||
| 41 | ### 2) Direct Authenticated WS | 71 | ### 2) Direct Authenticated WS |
| 42 | Run remote server network-bound: | 72 | Run remote server network-bound: |
| 43 | ```bash | 73 | ```bash |
| @@ -62,6 +92,7 @@ https://api.example.com/?t3Token=secret · 18 unmodified lines | |||
| 62 | Notes: | 92 | Notes: |
| 63 | - If `t3WsUrl` is `http://` or `https://`, it is normalized to `ws://` or `wss://`. | 93 | - If `t3WsUrl` is `http://` or `https://`, it is normalized to `ws://` or `wss://`. |
| 64 | - If no URL is provided, web falls back to same-origin WS using page protocol. | 94 | - If no URL is provided, web falls back to same-origin WS using page protocol. |
| 95 | - To avoid putting tokens in request logs/history, prefer fragment form (supported): `#t3WsUrl=...&t3Token=...` | ||
| 65 | 96 | ||
| 66 | ### Desktop App | 97 | ### Desktop App |
| 67 | Set remote mode env vars before launch: | 98 | Set remote mode env vars before launch: |