Module tunnel

Structs§

CloudflareTunnel: Cloudflare Tunnel — wraps the cloudflared binary. Requires cloudflared installed and a tunnel token from the Cloudflare Zero Trust dashboard.
CustomTunnel
NgrokTunnel: ngrok Tunnel — wraps the ngrok binary. Requires ngrok installed. Optionally set a custom domain (requires ngrok paid plan).
NoneTunnel: No-op tunnel — direct local access, no external exposure.
OpenVpnTunnel
PinggyTunnel
PublishedTcpService: A TcpService the tunnel actually published, with the endpoint clients use.
TailscaleSelf: This node’s tailnet identity, as reported by tailscale status --json.
TailscaleTunnel: Tailscale Tunnel — uses tailscale serve (tailnet-only) or tailscale funnel (public internet). Requires Tailscale installed and authenticated (tailscale up).
TcpService: A local daemon listener that terminates its OWN TLS (the mutually authenticated WSS RPC plane, the server-authenticated enrollment endpoint).
TunnelProcess: Wraps a spawned tunnel child process so implementations can share it.

TailnetSans: Outcome of resolving the tailnet names the daemon’s server certificate should carry. Unavailable is deliberately distinct from NotApplicable: a failed query says nothing about the names, so callers must not treat it as “this node has no tailnet names” and drop names a leaf already carries.

create_tunnel: Create a tunnel from config. Returns None for tunnel_provider “none”.
daemon_tcp_services: Resolve the daemon’s enabled self-TLS listeners from live config.
is_tailscale_ip: Whether ip is in Tailscale’s address space: the CGNAT range 100.64.0.0/10 or the tailnet ULA prefix fd7a:115c:a1e0::/48.
kill_shared: Kill a shared tunnel process if running.
new_shared_process
parse_tailscale_self: Extract the node identity from tailscale status --json. Missing or malformed fields yield an empty identity rather than an error; callers that need a real identity check TailscaleSelf::has_identity.
query_tailscale_self: Ask the local tailscaled who this node is.
tailnet_sans_from_status: Classify a tailscale status outcome. Only a usable identity (TailscaleSelf::has_identity) is Resolved. A failed or timed-out query, malformed output, and a successful status reported before tailscaled has its network map are all Unavailable, so the existing certificate keeps its names instead of being regenerated without them.
tailscale_server_sans: Resolve the tailnet names for the daemon’s self-TLS listeners (WSS, enrollment). Queries tailscaled only when the listeners are reached over the tailnet. Callers that start several listeners must resolve once and share the outcome, so every listener presents the same identity.