Skip to content
OpenChamber
↑↓Navigate ↵Open escClose

Tunnels

A tunnel is a link to your OpenChamber, so you can reach it from an ordinary browser on another network or, with Tailscale Serve, from any device in your tailnet. Use openchamber tunnel to create one for a running instance.

Connecting your own devices (the mobile app, another desktop) usually doesn’t need a tunnel — pair them instead and let the end-to-end encrypted Private Relay handle away-from-home access with zero setup.

Prerequisites

OpenChamber starts the tunnel provider CLI on your machine. Install the provider you want to use first:

Terminal window
brew install cloudflared
brew install ngrok

For Tailscale, install the Tailscale app and sign in. On a Mac the app is enough: OpenChamber finds its command-line tool inside the app.

Cloudflare quick tunnels can run with cloudflared. Ngrok requires an ngrok account and an authtoken from the ngrok dashboard:

Terminal window
ngrok config add-authtoken <your-ngrok-token>

Quick start

  1. Start OpenChamber:
Terminal window
openchamber

If you skip this step, openchamber tunnel start can auto-start a CLI server. When auto-starting, you can pass server options such as --port, --host, --lan, --ui-password, and --api-only.

  1. Start a Cloudflare tunnel:
Terminal window
openchamber tunnel start --provider cloudflare --mode quick

Or start an Ngrok tunnel:

Terminal window
openchamber tunnel start --provider ngrok --mode quick

Or share it with the devices in your tailnet through Tailscale Serve:

Terminal window
openchamber tunnel start --provider tailscale --mode serve
  1. Check status:
Terminal window
openchamber tunnel status

When the tunnel is up, status shows a public URL. Open it, or scan the QR code, to reach OpenChamber from anywhere.

By default, OpenChamber prints a QR code in interactive TTY sessions. Use --qr to force QR output, or --no-qr to disable it.

Providers

  • cloudflare: quick, managed remote, and managed local modes
  • ngrok: quick mode
  • tailscale: serve mode, reachable only from devices in your tailnet, and funnel mode, reachable from the whole internet

Tailscale

Both modes use your machine’s tailnet address, such as https://laptop.example.ts.net. Pick its port with --https-port: 443 (the default), 8443 or 10000. Change it when Tailscale already shares something else on 443.

The first time, Tailscale asks you to turn on HTTPS (for Serve) or Funnel for your tailnet. OpenChamber stops and shows Tailscale’s link: open it, approve, and start the tunnel again. On Linux, Tailscale lets only root or its operator share ports; make yourself the operator once with sudo tailscale set --operator=$USER.

Stopping the tunnel removes what OpenChamber shared through Tailscale and leaves the rest of your Tailscale setup alone.

Managed modes

Managed remote

Use a token + hostname managed by Cloudflare:

Terminal window
openchamber tunnel start --provider cloudflare --mode managed-remote --token-file ~/.secrets/cf-token --hostname app.example.com

Managed local

Use a local cloudflared config:

Terminal window
openchamber tunnel start --provider cloudflare --mode managed-local --config ~/.cloudflared/config.yml

Profiles (managed-remote)

Save a reusable profile:

Terminal window
openchamber tunnel profile add --provider cloudflare --mode managed-remote --name prod-main --hostname app.example.com --token-file ~/.secrets/cf-token

Start using the saved profile:

Terminal window
openchamber tunnel start --profile prod-main

Useful commands

Terminal window
openchamber tunnel providers
openchamber tunnel ready --provider cloudflare
openchamber tunnel ready --provider ngrok
openchamber tunnel doctor --provider cloudflare
openchamber tunnel doctor --provider ngrok
openchamber tunnel doctor --provider tailscale
openchamber tunnel stop --port 3000

Behavior notes

  • one active tunnel per OpenChamber instance (port)
  • starting a new mode/provider on same instance replaces previous tunnel
  • generating a new connect link revokes previous unused one
  • tunnel auto-start preserves server flags like --ui-password and --api-only in the instance settings used by restart/update flows