CADS-Tunnel

🔥 So what does this actually do?

You've got something running on your computer — a web app, a chatbot, a small server, a game, whatever — and you want someone else to be able to open it in a browser, without renting your own server, setting up port forwarding on your router, or wrestling with certificates.

That's exactly what the tunnel is for: a small program (ct-agent) runs on your computer, opens a connection outward, and says "fetch whatever's running locally here, at this address." The payload stays encrypted the whole way (end-to-end, not just to us) — as the operator of the relay infrastructure, we only see that data is flowing, never what's in it.

In short: for a few minutes, your laptop becomes a real, internet-reachable server — without handing an unencrypted copy of your data to some other company.

🚀 How it works — 3 steps

1. Create an account Sign in to the portal with your Google or GitHub account — no account yet? Signing up works exactly the same way, it's created automatically on your first login. No form, no password, no credit card — one click and you're done.
2. Create a tunnel Click "New tunnel" in the portal, give it a name and the local port you want to expose (e.g. 8080, if your thing runs on localhost:8080).
3. Paste one command The portal then shows you a ready-made command for your operating system (below). Paste it into your terminal / PowerShell, hit Enter — the command downloads the agent, registers it with us, and starts the tunnel. No manual install, no reboot needed.

That's it. As soon as the command finishes, your address is live — the URL shows up right there in your terminal and in your portal.

💻 The one-liner, by operating system

You'll get these commands personalized in the portal after step 2 (with a token that's valid once, for a limited time, in place of <your-token>) — here you're just seeing what they look like and what they do.

curl -fsSL https://bunsenbrenner.org/install.sh | CT_BOOTSTRAP=<your-token> sh

curl -fsSL https://bunsenbrenner.org/install.sh | CT_BOOTSTRAP=<your-token> sh

$env:CT_BOOTSTRAP='<your-token>'; irm https://bunsenbrenner.org/install.ps1 | iex

Security detail, for anyone curious: the token in that command is not your actual credential — it's itself only valid once, and gets exchanged server-side for the real keys. Even if this command ends up sitting in your shell history somewhere, it's useless to anyone the moment it's been used.

🧪 Prefer to play it safe? (Sandbox option)

ct-agent is a program that actively talks to the internet — just like any other network program. If you'd rather not expose your own machine directly, you can run the agent inside a lightweight, isolated sandbox (a Docker container) instead: even in the unlikely case of a bug or a compromised agent, your own files, programs, and data outside the container stay untouched. This is also the path the setup script itself calls "recommended isolation."

Only prerequisite: Docker is installed (Docker Desktop on macOS/Windows, Docker Engine on Linux — docs.docker.com/get-docker). Replace <your-token> and <your-hostname> as above with the values from your tunnel's page in the portal, and <your-local-port> with the port your thing runs on locally (e.g. 8080).

mkdir ct-tunnel-sandbox && cd ct-tunnel-sandbox
curl -fsSL https://raw.githubusercontent.com/scimbe/ct-agent/main/scripts/setup.sh | \
  CT_BOOTSTRAP=<your-token> \
  CT_AGENT_CP_URL=https://bunsenbrenner.org \
  CT_AGENT_HOSTNAME=<your-hostname> \
  CT_AGENT_ORIGIN=127.0.0.1:<your-local-port> \
  bash -s -- --docker

mkdir ct-tunnel-sandbox && cd ct-tunnel-sandbox
curl -fsSL https://raw.githubusercontent.com/scimbe/ct-agent/main/scripts/setup.sh | \
  CT_BOOTSTRAP=<your-token> \
  CT_AGENT_CP_URL=https://bunsenbrenner.org \
  CT_AGENT_HOSTNAME=<your-hostname> \
  CT_AGENT_ORIGIN=127.0.0.1:<your-local-port> \
  bash -s -- --docker

$env:CT_BOOTSTRAP='<your-token>'
$env:CT_AGENT_CP_URL='https://bunsenbrenner.org'
$env:CT_AGENT_HOSTNAME='<your-hostname>'
$env:CT_AGENT_ORIGIN='127.0.0.1:<your-local-port>'
&([scriptblock]::Create((irm https://raw.githubusercontent.com/scimbe/ct-agent/main/scripts/setup.ps1))) -Docker

Builds a slim image, starts the agent as a container named ct-agent, and registers it exactly like the direct install above — just locked in a box. View logs: docker logs -f ct-agent. Stop it: docker stop ct-agent. Reset everything: docker rm -f ct-agent (and delete the local .ct-agent-state folder if needed), then run the command again.

📶 And after that?

Your tunnel starts out on a shared certificate — that's plenty for getting started, and works in every browser with no warnings. Want your own certificate later, issued in your own name? Switch over in the portal with one click:

Rot (red) — not yet verified Gelb (yellow) — live, shared certificate Grün (green) — your own certificate, your own domain

For almost everyone, Gelb is perfectly fine to stay on permanently.

🛠️ For the tech nerds among you

Source code, architecture decisions (ADRs), threat model, and whitepaper: github.com/scimbe/CADS-Tunnel. The agent (ct-agent) you just installed has its own repo: github.com/scimbe/ct-agent — read the source, build the binary yourself, everything's open.

Ready?

One click, one command, live in under a minute.