Outbound, a minimal reverse tunnel in Go

Name: Outbound, a minimal reverse tunnel in Go
Availability: InStock
Author: kwakubiney

by kwakubiney·Feb 28, 2026·1 point·0 comments

Visit Project View on HN

AI Analysis

●●SolidNiche GemBig Brain

gRPC-based reverse tunnel, but ngrok/Cloudflare Tunnel already own this.

Strengths

•Long-lived bidirectional gRPC stream design avoids polling overhead
•Minimal auth model (pre-shared secret) reduces operational complexity
•Clean separation of concerns: TLS via proxy, HTTP/gRPC via edge binary

Weaknesses

•No clustering, persistence, or multi-tenant support limits production use
•Crowded tunneling space with dominant free alternatives (Cloudflare, ngrok)

Post Description

Hi HN, I built Outbound, a minimal self-hosted HTTP tunneling tool in Go. An agent running behind a firewall opens a long-lived bidirectional gRPC stream to an edge server. The edge accepts inbound HTTP requests and forwards them over the stream to the agent, which proxies them to local services and streams the response back. It is intentionally small: single-tenant pre-shared secret auth for agent registration, keepalives, and TLS termination handled by a reverse proxy (Caddy/nginx) in front of the edge.

I would love any feedback on the design, security assumptions, ergonomics, and what you would change or add if you were using this.