Open source · self-hosted

Serve Local Apps On Secure URLs

Fast, open source, and entirely under your control.

Uplink

Tunnels

3 tunnels · 2 serving

Add tunnel

app.uplink.computer Live

localhost:3000 · Private you + 3 invited 1.2k req · 84 MB

api.uplink.computer Live

localhost:8080 · Public anyone with the link 640 req · 12 MB

plex.uplink.computer Paused

localhost:5173 · Password shared password

Download for macOS Apple Silicon · Intel · Linux

uplink.yaml

YAML · UTF-8

services:
  web:
    port: 3000
    custom_domain: app.example.com
    share:
      - bob@uplink.computer
    team: true
  api:
    port: 8080
    public: true
    firewall: [api-limit]

firewall_rules:
  api-limit:
    match: { path: /api }
    rate_limit: { requests: 100, window_secs: 60, per: ip }

zsh — uplink

$ uplink up

✓ web private

→ https://web.uplink.computer

localhost:3000 · you + 1 invited

✓ api public

→ https://api.uplink.computer

localhost:8080 · api-limit · 100 req/60s

2 services online · serving

$ curl -fsSL https://uplink.computer/install.sh | sh

latest release · macOS + Linux

How it works

Serve your apps
without exposing your network.

A public edge server serves your domain and runs every firewall rule and auth check.
Your app stays on localhost, reached only through a tunnel it dials out to.

Public internet

Page views Password

API requests Token

Bots & scrapers blocked

Exploit attempts blocked

https

Uplink Edge server app.uplink.computer

HTTPS · TLS 1.3 Domain and certificates

WAF · Rate Limits Blocks security threats

Authentication Enforces who gets in

QUIC Tunnels Encrypted path to your machine

tunnels

Your machine localhost

private network

your app

localhost:3000

live

your api

localhost:8080

live

Use our managed edge network or host your own edge

Granular Access Control

Keep an app to yourself, invite people by email, protect it with a password, or open it to the world — and add an API token for scripts and webhooks. Unauthorized requests are blocked by the edge server and never reach your local host.

web.uplink.computer who gets in

Only you

Private by default — just your signed-in account.

Invited people

Add teammates by email; they sign in with their own account.

Password protected

Anyone with the shared password gets in — no account needed.

Public

Serve a site for anyone to access — no sign-in required.

Web Application Firewall

Apply rate limits and add custom rules to restrict access with IP allowlists, stop scrapers and bots, and prevent intrusion attempts. Rejected traffic is blocked at the edge and never reaches your local host. Write rules once and reuse across any app.

block-probes

Block Enforce

when path contains /wp-

and method is POST

1,204 blocked today

api-limit

Rate limit Enforce

when path starts with /api

100 req / 60s · per IP

no-scrapers

Block Monitor

when header user-agent contains bot

monitoring · 88 would match

Observability & Analytics

Aggregate statistics on your service health and bandwidth consumption. Monitor your security posture and audit requests that were blocked by firewall rules and authentication policies.

bandwidth · 24h photos

4.2GB

total

3.1GB

egress

1.1GB

ingress

blocked just now

blocked 203.0.113.7 POST /wp-login.php block-probes

rate-limited 198.51.100.4 /api · 40 req/s api-limit

unauthorized 192.0.2.9 GET /admin private

Traffic Inspector

Watch API callbacks arrive in real time. Inspect payloads, response codes, latency, and retry attempts without sending sensitive traffic to a third party. Captures stay local to your machine.

POST /callbacks/billing 200 182 ms

RequestJSON

{

"event": "invoice.paid",

"details": {…}

}

Response

{

"received": true,

"timestamp": 1783624935

}

Payload and headers captured locally 1.8 KB

Direct Connect

With Uplink running on both devices, the tunnel can be upgraded to an encrypted peer-to-peer link. Traffic flows straight between the two machines and never touches the edge. Lower latency and zero metered bandwidth.

notes.uplink.computer direct

uplink

This Mac

192.168.1.24

uplink

home-server

100.84.31.6

edge relay · bypassed

QUIC · end-to-end encrypted P2P Connection Established

Works with everything

Limitless compatibility
for all of your projects and services.

Frontend dev servers, self-hosted apps, databases, game servers, AI models.
If it listens on a local port, you can publish it.

Web frameworks

N Next.js
V Vite
A Astro
R Remix
S SvelteKit
N Nuxt
D Django
R Rails

Self-hosted apps

W WordPress
P Plex
J Jellyfin
H Home Assistant
N Nextcloud
I Immich
n n8n
G Gitea

Databases & services

P Postgres
R Redis
M MySQL
s sshd / sftp
M MongoDB
G Grafana
V Vaultwarden
M Minecraft

Local AI

O Ollama
v vLLM
l llama.cpp
O OpenCode
A Automatic1111
L LM Studio
C ComfyUI
O Open WebUI

…and everything else that speaks HTTP, gRPC, WebSockets, or SSE.

Recommended Apps

Open source apps from OpenLaboratory · the team behind Uplink

L Laboratory OS

Desktop environment for AI servers. The simplest way to self-host models and agents.

Learn more

O Open Knowledge

Self-host all of Wikipedia, with zim file management and an API+MCP server.

Learn more

A Autumn Leaves

SQL-native music library with built in stem-splitting and audio embeddings.

Learn more

Next Gen Transport Layer

The OpenTunnels Protocol.

A modern open source transport protocol for secure, high-performance tunnels.

QUIC + TLS 1.3

High performance, always encrypted, with a 1-RTT handshake (0-RTT on resume) and no plaintext mode to misconfigure.

Channel binding (RFC 9266)

Every credential is welded to the exact TLS session it rides on. A captured token is cryptographically inert on any other connection.

Scoped, short-lived grants

Each credential is a signed grant scoped to one namespace with a short expiry, so there is no long-lived bearer secret to leak or revoke.

Enforced tenant isolation

A credential authorizes one namespace, and the edge routes by that signed claim rather than the requested hostname.

Replay & exhaustion defenses

A fail-closed replay cache, strict wire parsing, and every length-prefixed read capped before allocation.

No head-of-line blocking

Each request rides its own QUIC stream with its own flow control, so one slow transfer never stalls the others.

Broad compatibility

HTTP, gRPC, WebSockets, and SSE on one encrypted QUIC connection, with each request riding its own stream.

Ed25519 identity

Each device holds an Ed25519 keypair, and tunnel credentials are bound to its public key.

Written in Rust

Minimal reliance on external packages, well-tested memory-safe code, dependencies audited on every build.

Read the protocol whitepaper

Pricing

Use Our Infrastructure
or Run Your Own.

Open source. MIT license. Host on your hardware or utilize our managed network.

Self-Hosted Edge Server

Free · Open source

Run your own edge on your own hardware.
Bring your own domain name, DNS configuration, and TLS certificates.

No SSO authentication, team features, advanced analytics, or security-event tracking.

Get started

Managed Edges

Preconfigured with seamless SSO authentication and Clickhouse-powered observability.

Global Edge Network

<region>.uplink.computer

Online

New York

United States

ny.uplink.computer

Online

San Francisco

United States

sf.uplink.computer

Online

London

United Kingdom

uk.uplink.computer

Online

Frankfurt

Germany

eu.uplink.computer

Online

Singapore

sg.uplink.computer

Free

$0 /mo

Kick the tires on a managed edge

1 GB bandwidth / month
Up to 10 Mbps transfer speeds
Reserved tunnel domain names
TLS 1.3 encryption for all apps

Start free

Dev

$10 /mo

Gateway to your personal cloud

Everything in Free
Up to 100 Mbps transfer speeds
20 GB bandwidth / month
Import 1 custom domain name

Start Developing

Pro

$50 /mo

Ship to production

Everything in Dev
Up to 2 Gbps transfer speeds
500 GB bandwidth / month
Import 5 custom domain names

Go Pro

Add a Team

Bring people in on top of any paid plan. Invite teammates and share your tunnels with the whole team in one click. No extra cost.

Invite teammates & manage access
Roles & permissions
Audit logs & security events
Shared apps and settings

$0 / teammate

Seats are free. You only pay for the plan underneath.

Add your team

For teams and businesses.

Dedicated Edge Cluster

$250 /mo per node

Private high-performance networking stack

Import unlimited custom domain names
Dedicated compute and bandwidth for your team
Up to 10 Gbps transfer speeds
Unlimited bandwidth (2 TB included, then $0.05/GB)
SOC 2 Type II infrastructure
Advanced analytics and security features.
Priority support & SLAs

Talk to us

Enterprise

Custom

Your cloud, your fleet, no limits

Deploy an edge fleet on your own infrastructure
LDAP, SAML, and custom SSO providers
ISO 27001 & SOC 2 Type II
GDPR & HIPAA support, signed BAA
Custom DPA & data-residency controls
Compliance reporting & audit support
Deployment and infrastructure consulting

Contact sales

Your first app online in minutes.

Install Uplink, chose a local port, and publish. That's it.

Get started See how it works

Serve Local Apps On Secure URLs

Tunnels

Serve your appswithout exposing your network.

Granular Access Control

Web Application Firewall

Observability & Analytics

Traffic Inspector

Direct Connect

Limitless compatibilityfor all of your projects and services.

Web frameworks

Self-hosted apps

Databases & services

Local AI

Recommended Apps

The OpenTunnels Protocol.

QUIC + TLS 1.3

Channel binding (RFC 9266)

Scoped, short-lived grants

Enforced tenant isolation

Replay & exhaustion defenses

No head-of-line blocking

Broad compatibility

Ed25519 identity

Written in Rust

Use Our Infrastructure or Run Your Own.

Self-Hosted Edge Server

Managed Edges

Free

Dev

Pro

Add a Team

Dedicated Edge Cluster

Enterprise

Your first app online in minutes.

Serve your apps
without exposing your network.

Limitless compatibility
for all of your projects and services.

Use Our Infrastructure
or Run Your Own.