OpenTunnel

OpenTunnel gives a service running on your laptop a stable, TLS-protected public address, and records every request that reaches it so you can inspect it and replay it. It runs as a hosted service at opts.ink (opens in a new tab), and anyone can self-host it. I designed and built all of it: the Go tunnel server and CLI, the wire protocol between them, and the dashboard.

The problem

Webhooks and OAuth callbacks need a public URL, and most tunnels hand you a random one that changes every time the tunnel restarts. Each restart meant re-pasting the URL into Stripe, GitHub and the OAuth provider, and losing the failed request I was trying to debug. I wanted a tunnel that behaves like infrastructure: a domain that stays mine, TLS without ceremony, and a record of exactly what was sent. I wrote about that itch in Building OpenTunnel.

What I built

• A single-binary Go CLI. opentunnel up 3000 --domain my-app exposes a local port at a persistent subdomain. It signs in through the browser, remembers your domain and port between runs, keeps its credentials in the operating system's keychain, and updates itself with verified releases.
• A Go tunnel server that routes public traffic for each subdomain to the right connected client.
• Request capture and replay. Every request is recorded with its headers, body, status and latency. A failed webhook can be replayed from the dashboard through the same tunnel, instead of asking the provider to send it again.
• A dashboard built with TanStack Start for domains, live traffic and replay history.
• Self-hosting. Docker images and Compose for a single host, plus guides for DNS, TLS, deployment and operations.

How it works

Each CLI keeps one authenticated WebSocket open, and that single connection carries many requests at once. Requests and responses travel as versioned protobuf messages, with bodies streamed in chunks under per-request flow control, and heartbeats detect dead connections.

Key decisions

• Contracts first. The REST API is described in OpenAPI and the tunnel protocol in Protobuf. The Go code and the dashboard's TypeScript types are generated from them, and CI fails if the generated code drifts from the contracts.
• Privacy in the capture. Sensitive headers are redacted before a captured request is saved, and captured bodies are size-limited.
• Built to be operated. Health checks, documented limits and a written security model, with builds for macOS, Linux and Windows: nine releases in its first month.

OpenTunnel is source-available under the PolyForm Noncommercial licence. Anyone can read the code, run it and self-host it.