tigby tunnel

A Tunnel gives an Identity a public hostname on the Tunnel domain. The agent dials out, so nothing has to be open on the machine running this command. The connection authenticates with the Identity Key, which is shown once when the Identity is created.

tigby tunnel connect

Run the Tunnel in the foreground.

Connects the Identity's Tunnel and forwards every public request to a local port until Ctrl-C. Reconnects on its own with jittered backoff, and follows a planned handover without dropping requests that are in flight. With --json every event is one JSON document on a line of its own.

tigby tunnel connect [handle] [options]

tigby tunnel connect @orderbot --port 3000
tigby tunnel connect @orderbot --port 5432 --tcp
TIGBY_IDENTITY_KEY=tigby_id_… tigby tunnel connect --port 3000 --json

tigby tunnel status

Show where a Tunnel is reachable.

The Tunnel's public hostname, both of its raw-TCP addresses – the allocated port when it has one, and the SNI collector – and the connect endpoint an agent dials. Whether anything is serving the Tunnel is answered by one request to the public hostname – which reaches the agent's own server when one is connected.

tigby tunnel status <handle> [options]

tigby tunnel claim-port

Give the Tunnel a raw-TCP port of its own.

Takes a port from the deployment's pool and keeps it for this Tunnel. Ask for one when a raw-TCP client has to reach the agent and cannot speak TLS with SNI – psql, ssh, a game server. Everything else already works without one: HTTP and WebSocket arrive on the hostname, and raw TCP that can do SNI arrives on the collector port. Asking twice gives the same number back. A Tunnel that is connected is cut so it comes back with the port bound; the agent reconnects on its own.

tigby tunnel claim-port [handle] [options]

tigby tunnel claim-port @orderbot
TIGBY_IDENTITY_KEY=tigby_id_… tigby tunnel claim-port --json

tigby tunnel release-port

Hand the Tunnel's raw-TCP port back.

Returns the number to the pool for another Identity to claim. The Tunnel stays and keeps serving HTTP, WebSocket and raw TCP by SNI. Live connections of this Identity are cut as part of the release – a number that went back to the pool must stop being served before somebody else is given it – and a running agent reconnects on its own. Claiming again may well hand out a different number.

tigby tunnel release-port [handle] [options]

This command cannot be undone, so it asks before it acts. --yes answers in advance; --json implies it.

tigby tunnel release-port @orderbot