Open source · self-hosted

Bring your apps online

Fast, open source, and entirely under your control.

Uplink

3 tunnels · 2 serving

＋ Add tunnel

◎admin-dashboard.ny.uplink.computerLive

localhost:3000Private

◎your-company.comLive

localhost:8080Public

Uplink

3 tunnels · 2 serving

Add tunnel

https://admin-dashboard.ny.uplink.computer Live

localhost:3000 · Private you + 3 invited 1.2k req · 84 MB

https://your-company.com Custom domain Live

localhost:8080 · Public anyone with the link 54.2k req · 741 MB

https://your-api.ny.uplink.computer Paused

localhost:5173 · API Key protected with bearer token

Download for macOS Apple Silicon · Linux: install the CLI

uplink.yaml YAML

services:

web:

port: 3000

public: true

api:

port: 8080

- alice@company.com

uplink.yaml

YAML · UTF-8

edge: ny.uplink.computer
services:
  web:
    port: 3000
    custom_domain: dashboard.example.com
    share:
      - bob@company.com
      - alice@company.com
  api:
    port: 8080
    account: acme
    allow_ips: [203.0.113.0/24]
    rate_limit:
      requests: 100
      window_secs: 60
      per: ip
  blog:
    port: 9000
    public: true
    custom_domain: blog.example.com

zsh — uplink

$ uplink up

✓ web

→ https://dashboard.example.com

localhost:3000 · you + 2 invited

✓ api

→ https://api-8080.ny.uplink.computer

localhost:8080 · acme account · IP allowlist

✓ blog

→ https://blog.example.com

localhost:9000 · public

2 services online · serving

$ curl -fsSL https://uplink.computer/install.sh | sh

latest release · Linux x86_64 & arm64 — macOS: use the desktop app

How it works

Serve local apps
without exposing your network.

A public edge server serves your domain and runs every firewall rule and auth check.
Your app stays on localhost, reached only through a tunnel it dials out to.

◎

Internet

→

◇

Edge

→

▣

localhost

TLS Auth Firewall Encrypted tunnel

Public internet

Page views Password

API requests Token

Bots & scrapers blocked

Exploit attempts blocked

https

Uplink Edge server app.uplink.computer

HTTPS · TLS 1.3 Domain and certificates

Access Controls who and where gets in

Firewall Blocks request-level threats

QUIC Tunnels Encrypted path to your machine

tunnels

Your machine localhost

private network

your app

localhost:3000

live

your api

localhost:8080

live

Use our managed edge network or host your own edge
Powered by the OpenTunnels Protocol.

Share it before you ship it.

Whether it's npm run dev or a Compose stack, one command puts the build on a real HTTPS URL that only invited teammates can open—WebSockets and server-sent events included, so hot reload and streaming just work.

your-laptop — ~/app

$ npm run dev

ready in 312 ms

➜ Local: http://localhost:4321

api Docker container :8080

demo Gradio app :7860

preview-41k15n.uplink.computer Private

invited team only HTTPS WSS SSE

Your homelab, on any device.

Smart TVs, e-readers, a friend's phone—devices that can't run a VPN client still reach your apps. And each URL opens exactly one app, so untrusted devices never get whole-network access.

home-pc online

Immich photos · :2283
Jellyfin media · :8096
Home Assistant home · :8123

smart-tv IP allowlist

media-41km3m.uplink.computer

friend's phone invited by email

photos-41km3m.uplink.computer

work laptop password gate

home-41km3m.uplink.computer

One app per URL—your network stays invisible.

Skip cloud costs, leverage local hardware

Easier and more secure than accepting inbound connections to your local IP address. Built on the OpenTunnels protocol, with QUIC multiplexing with no head-of-line blocking; it stays fast and low-latency under heavy load.

Raspberry Pi local server

app :8080
postgres stays private
redis stays private

app.company.com

Requests · last 24h 12.3M

4.8k req/s current throughput

9.4 Gbps peak data transfer

2.1k threats blocked

Zero-Trust Access Control

Choose who can reach each app: people, teams, passwords, API keys, or trusted networks. Everything else stops at the edge.

Invited accounts Sign in with a code sent to their email.

alex@example.com

Team access Share with your whole team in one click.

acme · 12 members

Password / API key Use a browser password or Authorization header.

•••••••• Replace

IP whitelist Only listed IPs and networks can connect.

203.0.113.0/24

Public access Open to anyone with the link

Web Application Firewall

Block exploit probes, abusive requests, and sensitive paths with reusable HTTP rules before requests reach your machine.

block-probes applies to: blog Block Enforce

where path contains /wp- · method is POST 1,204 blocked today

block-secrets applies to: api Block Enforce

where path contains /.env 86 blocked today

block-curl applies to: all tunnels Block Monitor

where header user-agent contains curl monitoring · 312 would match

Bot Protection

Challenge suspicious traffic at the edge without putting a CAPTCHA in front of every visitor. Set a challenge level per app—from invisible browser proof to a strict human check.

Managed Challenge Per-app challenge difficulty

JS proofCoherenceReaction

Signed clearance All regions · 30 minutes

Observability & Analytics

See bandwidth, service health, and blocked requests in one place. Know what is happening without assembling another stack.

last 24h 1.87m Requests

blocked 203.0.113.7 · POST /wp-login.php block-probes

Traffic Inspector

Inspect live request and response bodies without sending payloads to a third party. Captures stay on your machine.

POST /callbacks/billing 200 182 ms · local

Request body

{

"event": "invoice.paid",

"invoice": {…}

}

Response body

{

"received": true,

"status": 200

}

Custom Domains & Load Balancing

Attach your own domains to any tunnel and balance traffic across several connectors. DNS, certificates, and failover are handled at the edge.

api.example.com api · :8080 across 3 independent devices

Attached

server-a · New York :8080 34%
server-b · Toronto :8080 33%
server-c · London :8080 33%

Failover automatic Unhealthy connectors drop out

Seamless support
for modern web protocols

Leave behind the hidden headaches of traditional reverse tunnel tools.

Automatic HTTPS

Issued and renewed automatically for every served app. Assigned URLs are yours forever.

WebSockets

WSS support by default, upgrade requests pass through without special proxy rules.

Server-Sent Events

Durable SSE, live updates and AI responses stay connected from first event to last.

Verified compatibility with popular apps

If it listens on a local HTTP port, it is ready for Uplink.

Nextcloud
Home Assistant
Jellyfin
Immich
Grafana
Gitea
n8n
WordPress
Plex
Portainer

Ollama
LM Studio
Jupyter
Gradio
Express
FastAPI
Next.js
Vite
Astro
vLLM

Keep Tailscale. Keep Compose.
Add Uplink.

Uplink doesn't replace the stack you've already built—it publishes it, and stands guard in front of it. Your tailnet, Compose files, and services stay exactly as they are.

Your tailnet private mesh

your-laptop

your-phone

home-server online

docker compose

app :8080
photos :2283
media :8096

Uplink tunnel QUIC · TLS 1.3 ALLOW :8080 · :2283 DENY all other ports

Uplink edge HTTPS

app.example.com

photos-41km3m.uplink.computer

default deny · bot protection on

Outside world

customer anywhere

friend invited

bot blocked

Docker runs the apps Compose files unchanged

Tailscale meshes your devices One private network, wherever they are

Uplink publishes & protects Device-bound tunnel, allowlisted ports

Pricing

Use Our Infrastructure
or Run Your Own.

Open source. MIT license. Host on your hardware or utilize our managed network.

Self-Hosted Edge Server

Free · Open source

Run your own edge on your own hardware.
Bring your own domain name, DNS configuration, and TLS certificates.

No built-in SSO authentication, bot protection, or advanced analytics.

Get started

Managed Edges

Preconfigured with seamless SSO authentication and Clickhouse-powered observability.

Free

$0 /mo

Kick the tires on a managed edge

Unlimited HTTPS encrypted apps
1 GB bandwidth / month
Up to 10 Mbps transfer speeds
Reserved internal subdomains

Start free

Dev

$10 /mo

Gateway to your personal cloud

Everything in Free
50 GB bandwidth / month
Up to 100 Mbps transfer speeds
Link 3 custom domain names

Start Developing

Pro

$50 /mo

Ship to production

Everything in Dev
1 TB bandwidth / month
Up to 1 Gbps transfer speeds
Link 20 custom domain names

Go Pro

Add a Team

Bring people in on top of any paid plan. Invite teammates and share your tunnels with the whole team in one click. No extra cost.

Invite teammates & manage access
Roles & permissions
Audit logs & security events
Shared apps and settings

$0 / member

Seats are free. You only pay for the plan underneath.

Add your team

For teams and businesses.

Dedicated Edge Cluster

$250 /mo per node

Private high-performance networking stack

Dedicated compute and bandwidth for your team
Up to 10 Gbps transfer speeds
Uncapped bandwidth (5TB included, then $0.05/gb)
Link up to 10,000 custom domain names
Advanced analytics and security features.
Priority support & SLAs

Talk to us

Enterprise

Custom

Your infrastructure, infinite scale

Deploy a multi-site edge fleet
Use your own physical and cloud infrastructure
LDAP, SAML, and custom SSO providers
Priority support & dedicated onboarding
Custom DPA & data-residency controls
Compliance reporting & audit support

Contact sales

Next Gen Transport Layer

The OpenTunnels Protocol.

A modern open source transport protocol for secure, high-performance tunnels.

QUIC + TLS 1.3

High performance multiplexing-optimized transport with a 1-RTT handshake (0-RTT on resume). TLS 1.3 encryption by default on every connection.

Channel binding (RFC 9266)

Every credential is welded to the exact TLS session it rides on. A captured token is cryptographically inert on any other connection.

Broad web compatibility

HTTP requests, WebSocket upgrades, and SSE streams share one encrypted QUIC connection, with each request bound to the device Ed25519 identity.

Enforced tenant isolation

Tunnel credentials are bound to device public keys, edges route by that signed claim rather than the requested hostname.

No head-of-line blocking

Each request rides its own QUIC stream with its own flow control, so one slow transfer never stalls the others.

Written in Rust

Minimal reliance on external packages, well-tested memory-safe code, dependencies audited on every build.

QUIC + TLS 1.3

Channel binding (RFC 9266)

Broad web compatibility

Enforced tenant isolation

No head-of-line blocking

Written in Rust

Read the protocol whitepaper

Your first app online in minutes.

Install Uplink, point it at a local HTTP port, and publish. That's it.

Get started See how it works

$ curl -fsSL https://uplink.computer/install.sh | sh

latest release · Linux x86_64 & arm64 — macOS: use the desktop app

Bring your apps online

Serve local apps without exposing your network.

Share it before you ship it.

Your homelab, on any device.

Skip cloud costs, leverage local hardware

Zero-Trust Access Control

Web Application Firewall

Bot Protection

Observability & Analytics

Traffic Inspector

Custom Domains & Load Balancing

Seamless support for modern web protocols

Automatic HTTPS

WebSockets

Server-Sent Events

Verified compatibility with popular apps

Keep Tailscale. Keep Compose. Add Uplink.

Use Our Infrastructure or Run Your Own.

Self-Hosted Edge Server

Managed Edges

Free

Dev

Pro

Add a Team

Dedicated Edge Cluster

Enterprise

The OpenTunnels Protocol.

QUIC + TLS 1.3

Channel binding (RFC 9266)

Broad web compatibility

Enforced tenant isolation

No head-of-line blocking

Written in Rust

Your first app online in minutes.

Serve local apps
without exposing your network.

Seamless support
for modern web protocols

Keep Tailscale. Keep Compose.
Add Uplink.

Use Our Infrastructure
or Run Your Own.