Office software, reachable from anywhere

Plenty of businesses still run critical software on a server in the office: an accounting package, a dispatch system, a database the vendor stopped updating years ago. The office sits behind NAT, so remote staff can’t reach any of it.

The usual fixes are bad ones. Port forwarding exposes a legacy app to the open internet, and a full VPN hands every laptop the entire office network when it only needs one application.

Tunnel Hub routes everything through one hardened VPS. Employees connect over encrypted VLESS + Reality or Shadowsocks 2022 tunnels into a sing-box gateway, and each tenant’s FRP server accepts a reverse tunnel that the on-premises agent opens from inside the office. No inbound port ever opens on the office router.

The agent reaches the legacy software over local TCP and carries the traffic back out, so the application itself never learns it’s being used from a kitchen table two states away.

A Go management hub behind a Caddy admin entry owns the configuration as YAML. Agents poll it over HTTP every 30 seconds, which means a new tenant provisions itself: create the config, and the moment its agent starts, it pulls credentials and comes online.

The platform is containerized, provisioned with Terraform, and runs multi-tenant in production.