So you don’t want to port-forward on your home router or have Cloudflare decrypt all your traffic? Check out Towonel.
Most open source Cloudflare Tunnel alternatives involve setting up a VPS, terminating TLS there on a reverse proxy, then setting up a Wireguard tunnel to your server at home.
Towonel is different: it does not decrypt your traffic on the VPS and you can easily share one, so not every self-hoster has to buy and maintain a VPS.
Check it out!
Mastodon link: https://gts.erwanleboucher.dev/@eleboucher/statuses/01KS4YNA2SYMSP0FSKJVNJA155
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters IP Internet Protocol LXC Linux Containers NAS Network-Attached Storage NAT Network Address Translation NUC Next Unit of Computing brand of Intel small computers SSL Secure Sockets Layer, for transparent encryption TCP Transmission Control Protocol, most often over IP TLS Transport Layer Security, supersedes SSL VPS Virtual Private Server (opposed to shared hosting)
8 acronyms in this thread; the most compressed thread commented on today has 15 acronyms.
[Thread #304 for this comm, first seen 21st May 2026, 13:30] [FAQ] [Full list] [Contact] [Source code]
Very cool. I personally use a double wireguard network: a wireguard vpn at home for all my services, and then since my home network is behind a double NAT and impossible to access publicly, I use a second wireguard tunnel to a VPS, to forward traffic to my internal wireguard network. The only thing the VPS can see is encrypted wireguard packets.
Edit: it seems like this service is more for public or shared services (like a public blog), rather than private personal services, so wireguard is less of an option
Oh, nice find. I’m saving that
It’s interesting OP. I use the evil Cloudflare Tunnels/Zero Trust, and I’m pretty much sold on it, much to the chagrin of others here. Yes, there are caveats, pros and cons. Even tho I am sold on the product, I would entertain a clone/fork/rewrite if it gave me everything that Cloudflare Tunnels/Zero Trust along with the security features. I’ll do some reading once the blog is back up.
Oh great. So now there’s a tuwunel and a towonel and they’re completely different things.
(tuwunel is a fork of the matrix backend conduwuit. not to be confused with continuwuity, another conduwuit fork)
I know, the naming isn’t ideal.
On the bright side, you can now expose multiple tuwunel instances via a single towonel and federate with other tuwunels on other towonels for maximum
uwu owoWhich is almost what my friends and I are doing, except we’re running continuwuity instead of tuwunel.
What other apps are in the UwU stack?
Uh. Blog is down. All I get is an 404 for the link in the Mastodon post.
Edit: Here’s a link that works: https://github.com/eleboucher/towonel
or https://web.archive.org/web/20260521095433/https://erwanleboucher.dev/blog/towonel/
edit: it’s back up
Is the agent only available as a docker image? I quite like the option to run Cloudflare tunnels as a local service (e.g. in LXCs).
I’m sorry, I’m not that familiar with LXC.
Erwan will make binaries available ASAP, would that help you?
That would help, yes. 👍
LXCs are a form of virtualization. It’s a container running its own isolated Linux userland while sharing the host’s kernel and hardware resources.
Here they are: https://codeberg.org/towonel/towonel/releases
So I built towonel. In Rust, partly because I wanted to learn the language properly
This bit makes me a little wary.
Why? I didn’t know python until one of my clients decided they would only use it for everything going forward. It took me all of a day to start converting C# code and this was a decade before LLMs.
Knowledge of a specific language does not reflect development skill.
Yes, but ported C# usually doesn’t make for the most idiomatic Python.
99% of the time that doesn’t matter, but a highly security sensitive reverse proxy shared by multiple users most likely part of the stack to be attacked might be an exception.
I like how you just assumed that what I was doing wasn’t security oriented…
Was it?
It dealt with debit and credit card transactions…
