Originally didn't want to share but here it is https://github.com/reddec/tunnel-me

UI: fully LLM assisted (not vibe coded, but guided with a lot of iterations). Backend: hand written, but before release polished via LLM. Docs: me - input, LLM - output.

The things I am proud:

- it very reliable

- its single binary with reasonable defaults and low memory usage

- SSO out of the box (cause I am using pocketid in my homelab)

- very simple backend

The vps runs a custom image that is 2.54 Megabytes. It has a custom kernel with almost everything but networking and wireguard disabled, a fixed-size fs with pre-allocated blocks and inodes to hold the vps wireguard key, and a single pid 1 binary that calls the kernel directly to set up the routing rules, generate a new wireguard key on first boot and save it to the fs, print out the wireguard public key to the console, and loops reap. Updating involves building and uploading a new image, assigning the vps to use it, reboot, wait for the public key in the console then set it on the nas so they can talk.

we removed anonymous usage of our product many years ago because it was far and away the largest source of abuse on our entire platform.

i believe at this point that that anonymous, account-less tunneling services like this are net negative for the security of the internet

happy to answer any questions from the community

It’s interesting that 10 (more?) years later the product has not evolved and, apparently, hasn’t found a way to finance itself without removing the pure free tunneling option.

ssh -p 443 -R0:localhost:9051 free.pinggy.io

(Free for 1h each session)