Tunlr - Distributed Reverse Proxy for Dynamic Environments

TL;DR

TL;DR: Tunlr is an open-source distributed reverse proxy that exposes local development servers to the internet with custom domains, TLS certificates, and client authentication — self-hostable or use their hosted service.

Source and Accuracy Notes

⚠️ This section is MANDATORY. All links must be verified from actual source, not guessed.

• Project page: tunlr.dev ← MUST visit and verify
• Source repository: github.com/candiddev/tunlr ← MUST read README
• Open source details: candid.dev/open-source
• License: source-available (specific license terms verified via project page)
• HN launch thread: news.ycombinator.com/item?id=43400562

What Is Tunlr?

Tunlr is a distributed reverse proxy built for developers who need to expose dynamic local environments to the internet. Unlike basic tunnel tools, Tunlr is designed around the premise that modern development involves complex multi-service setups — not just a single localhost port.

The project positions itself as an ngrok alternative with a key difference: you can bring your own domain names and TLS certificates, and optionally self-host the entire infrastructure.

Core capabilities:

• One-line CLI command to proxy access to local services
• Customizable client configuration for multi-service and complex environment exposure
• Self-hosted server option with Bring Your Own Domain (BYOD)
• Client authentication and mutual TLS (mTLS) certificate support
• Distributed architecture built on Cloudflare Workers

Setup Workflow

Step 1: Install the CLI

macOS (Intel):

curl -L https://tunlr.dev/releases/tunlr_darwin_amd64.gz | gzip -d > tunlr
chmod +x tunlr

macOS (Apple Silicon):

curl -L https://tunlr.dev/releases/tunlr_darwin_arm64.gz | gzip -d > tunlr
chmod +x tunlr

Linux (amd64):

curl -L https://tunlr.dev/releases/tunlr_linux_amd64.gz | gzip -d > tunlr
chmod +x tunlr

Linux (ARM64):

curl -L https://tunlr.dev/releases/tunlr_linux_arm64.gz | gzip -d > tunlr
chmod +x tunlr

Windows:

curl -L https://tunlr.dev/releases/tunlr_windows_amd64.gz | gzip -d > tunlr.exe

Verify the binary after download:

sha256sum tunlr | grep $(curl -L https://tunlr.dev/releases/tunlr_darwin_amd64.sha256)

Step 2: Run the Tunnel

After installation, point tunlr at your local service:

./tunlr proxy http://localhost:3000

Tunlr will assign a public URL pointing to your local http://localhost:3000.

Step 3: Connect with a Custom Domain (Optional)

If self-hosting, configure your own domain:

./tunlr proxy --domain yourservice.yourdomain.com https://localhost:8080

Step 4: Container Deployment

Tunlr is also available as a container image for server-side deployments:

docker pull ghcr.io/candiddev/tunlr

Deeper Analysis

Architecture: Tunlr uses Cloudflare Workers as its distributed edge layer, which gives it global anycast-style routing without managing your own fleet. The self-hosted path uses a control plane + data plane split — you run the coordination layer, clients connect to your edge.

vs. ngrok: ngrok’s free tier is rate-limited and gives you random subdomains. Tunlr’s self-hosted option means you control the entire tunnel infrastructure with your own TLS certs. For teams already on Cloudflare, this integrates naturally.

vs. Cloudflare Tunnel (argo-tunnel): Cloudflare Tunnel requires the cloudflared daemon and is oriented toward permanent infrastructure exposure. Tunlr is designed for transient, developer-targeted use cases with a cleaner CLI UX.

Security model: The README explicitly calls out client authentication and TLS certificates. For teams needing to restrict tunnel access to authorized clients only, this is a meaningful differentiator over basic tunnel tools.

Current state: The GitHub repo shows active development with monthly release cycles (v2026.07 was released July 2026). Stars are currently low, which is typical for newer open-source infrastructure tools.

Practical Evaluation Checklist

• CLI installs and runs without dependencies: yes (single static binary)
• Supports multiple OS/arch combinations: yes (macOS, Linux, Windows; amd64 + ARM64)
• Custom domain support: yes
• Self-hosted option: yes
• TLS/mTLS support: yes (client auth + TLS certs)
• Container image available: yes (GitHub Container Registry)
• SBOM (Software Bill of Materials): yes (CycloneDX format)
• Active development: yes (monthly releases through mid-2026)

Security Notes

• All tunnel traffic uses TLS encryption by default
• Mutual TLS (mTLS) available for client certificate authentication
• SHA256 checksum verification recommended for binary downloads
• Self-hosted deployments keep tunnel traffic under your own infrastructure control

FAQ

Q: Is Tunlr free to use? A: Tunlr is open-source and self-hostable at no cost. They also offer a hosted service at tunlr.dev with their own infrastructure.

Q: How does this differ from ngrok? A: ngrok provides a hosted tunnel service with a free tier. Tunlr is fully open-source, supports Bring Your Own Domain, self-hosting, and includes mTLS client authentication — targeting teams who want full control of their tunnel infrastructure.

Q: Does it support multiple services at once? A: Yes. The client configuration can expose multiple services and complex multi-port development environments through a single tunnel entry point.

Q: What platforms are supported? A: Binaries are available for macOS (Intel and Apple Silicon), Linux (amd64, arm, arm64), and Windows (amd64). A container image is also published to GitHub Container Registry.

Q: Can I use my own TLS certificates? A: Yes. Tunlr’s self-hosted mode supports Bring Your Own Domain with your own TLS certificates.

Conclusion

Tunlr fills a specific niche: developers who want the simplicity of a one-line tunnel tool but the control of self-hosted infrastructure. Its Cloudflare Workers foundation gives it a global distributed edge without operational overhead, while the self-hosted path is there for teams with strict data residency or corporate network requirements.

The mTLS support and SBOM availability signal a security-conscious design — appreciated in a category where many tunnel tools are treated as disposable utilities. Worth evaluating alongside Cloudflare Tunnel and ngrok for any team regularly exposing local dev environments externally.