Get connected. Or run the whole thing.

Install the client

On macOS or Linux, install with Homebrew or curl.
Choose a method: brewcurl

brew install ynui/tap/inlet

Create a token and start a tunnel

Start your app first. Replace 3000 with the port your app listens on.

inlet login
inlet http 3000

Use inlet login to link device tokens to GitHub. It opens a browser for approval, then returns to the terminal and saves an inlet token and server URL locally. Use inlet signup for an open token under the server’s per-IP limit. The client prints the public link; share it to let someone reach your app. Press Ctrl-C to stop the tunnel. Inlet does not save your GitHub access token.

Client commands

Setup and checks

Sign in and tokens

Run a tunnel

Troubleshooting

• Start with inlet doctor --port 3000. It checks the configured server and your local app.
• The public link does not load. Confirm your app is running on the port you passed to inlet http, and that the tunnel is still running. Ctrl-C stops it.
• Connection or token errors. Run inlet config show to check the saved server and token status. A revoked token cannot open new connections; run inlet login again, or inlet auth <token> with a token from the operator.
• The browser does not open during login. Run inlet login --no-browser and finish approval in any browser.
• See what your app received. Open the inspector at http://127.0.0.1:4040. If that port is taken, choose another with --inspect.
• WebSocket features fail through the public URL. Inlet forwards HTTP only; WebSocket upgrades from the public app URL are not supported.

1. Prepare the server

Point a DNS name such as inlet.example.com at your server. Install Docker with the Compose plugin, then clone inlet and set the public URL in its environment file.

git clone https://github.com/ynui/inlet.git
cd inlet
cp .env.example .env

Then set these values in .env:

INLET_PUBLIC_BASE=https://inlet.example.com
INLET_OPEN_SIGNUP=false
INLET_ADMIN_TOKEN=<long-random-secret>
INLET_GITHUB_CLIENT_ID=<oauth-app-client-id>
INLET_GITHUB_CLIENT_SECRET=<oauth-app-secret>

Start the server and check its logs:

docker compose up -d --build
docker compose ps
docker compose logs -f inletd

Set INLET_PUBLIC_BASE to the HTTPS address users will open. To offer GitHub login, create a GitHub OAuth App, enable Device Flow, and set both GitHub credentials.

Set INLET_OPEN_SIGNUP=true to let anyone create an account. When it is false, only invited users can sign up; existing users can still add tokens. Otherwise, keep signup invite-only. Create a strong admin secret with openssl rand -hex 32 and put its output in INLET_ADMIN_TOKEN.

Prefer not to use Docker? Download the inletd archive from Releases, or build from source: install Go 1.23+, clone the repository, run make build, then start ./inletd. Put server settings in .env or export the matching INLET_* variables before starting it.

Server environment variables

Configuration precedence: startup defaults → ~/.config/inlet/server.json → CLI flags → environment variables. Remote setting changes made with inlet admin persist in the database and take precedence thereafter.

2. Put HTTPS in front

Terminate TLS at Nginx and forward every path to inlet's listener. Add the map once inside Nginx's http block; put the server block in your site config. Replace the hostname, certificate paths, and upstream for your deployment.

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    listen [::]:80;
    server_name inlet.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name inlet.example.com;

    ssl_certificate /etc/letsencrypt/live/inlet.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/inlet.example.com/privkey.pem;

    # nginx defaults to 1m; raise it to your largest expected upload.
    client_max_body_size 50m;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;

        # Keep long-lived client connections open and stream bodies unbuffered.
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
        proxy_buffering off;
        proxy_request_buffering off;
    }
}

3. Invite clients and administer the server

With INLET_ADMIN_TOKEN set and the server running, connect from your workstation with inlet admin.

inlet admin auth --server https://inlet.example.com <admin-token>
inlet admin invite create --ttl 24h --label teammate
inlet admin token list --limit 50 --offset 0

Send the one-time invite code to the client. They claim it with inlet signup --server https://inlet.example.com --invite <invite-code>; the client saves the token and server URL.

Admin command reference

Run from your workstation with inlet admin. Credentials are saved separately in ~/.config/inlet/admin.json and never touch client configs. Remote commands require HTTPS (or loopback in development).

Authentication and configuration

Invites

Tokens

Local server commands

Run these inside the server container or from the working directory containing its database (default ./data/inlet.db). With Docker Compose, prefix each command with docker compose exec inletd.

Operate and troubleshoot

docker compose ps
docker compose logs -f inletd
docker compose exec inletd inletd doctor
docker compose exec inletd inletd invite create --ttl 24h --label teammate
docker compose exec inletd inletd token list
docker compose down

To update, pull the latest source and run docker compose up -d --build. For configuration options and the full proxy example, see the deployment guide on GitHub.