STATIC BUNDLE · TYPED LANES · NO SSH DEPLOYMENT

One installed runtime.
Many tunnel shapes.

Tunnel Agent installs a complete, hash-verified transport bundle under /opt/tunnel-agent. Enabling HPNSSH, WSTunnel, Rathole, or TrustTunnel never waits for a server-side binary download.

Open @TunnelOwnersBot Read bootstrap flow
HPNSSHWSTUNNELRATHOLETRUSTTUNNELSTATIC MUSL

01

Create a cluster

Every cluster belongs to its owner. A server must be attached to at least one cluster before it can receive an enrollment command.

02

Classify the node

Choose domestic or foreign. Domestic nodes prefer the Iranian bundle mirror; foreign nodes use this verified static site.

03

Run one command

The bot issues short-lived enrollment commands. The installer verifies the archive hash, writes the bundle atomically, creates a node identity, and starts the runtime.

BUNDLE LAYOUT

Everything needed by a lane is already on disk.

/opt/tunnel-agent/
├── current -> releases/vX.Y.Z
├── releases/vX.Y.Z/
│   ├── bin/tunnel-agent
│   ├── bin/wstunnel
│   ├── bin/rathole
│   ├── bin/trusttunnel_endpoint
│   └── hpnssh/{bin,sbin,libexec}/
└── state/

A

Immutable release paths

Every bundle has an exact version and SHA-256. Existing releases are never overwritten.

B

Local toggles

Tunnel changes select declared contracts from the installed bundle. Runtime supervision does not download artifacts.

C

Safe overlap checks

Typed manifests reject local listener collisions before a transport process starts.