Guide contents3 of 9
Publish a web or API
From app=3000 to an address with HTTPS, with password or token if needed.
The basics
On your machine
lnkstart add app=3000 lnkstart add api=8080 nas=192.168.1.20:5000
app=3000 ends up at app.tunnels.midominio.com. The second line publishes two things, and one lives on another machine on your local network.
WebSockets and long responses (SSE, downloads) pass through as-is. If your app needs to see the public domain in the Host header, add --preserve-host; to remove it, run the same add again without the option.
Before publishing, add asks the app for what nobody wants to publish by accident: a .env with keys, the .git folder, AWS credentials or Flask's debug console. If it serves any of them, it does not publish and says how to fix it (--force publishes anyway). phpinfo, server-status and the like only warn. It is all checked on your machine: nothing leaves it.
Protect access
On your machine
lnkstart add app=3000 --password lnkstart add app=3000 --access-token lnkstart add app=3000 --no-password
The password is entered without echoing (or via LNKSTART_PASSWORD). The token is shown once and goes in the x-lnkstart-token header: for webhooks and scripts.
Protection is on the name, not the session: it stays in place even if you restart the agent, until you remove it with --no-password or --no-access-token. The password or token never reach your app.
Temporary access, without giving the password
On the VPS
sudo lnkstart server share app --for 2h --once --pin
It prints a link (and a PIN), shown once; --note says who it is for. Whoever opens it gets in without knowing the password until it expires; with --once, only the first person. Opening it does not spend it: pressing Enter does, so a chat's link preview does not take it. Also from the console, on the service's page.
sudo lnkstart server share list says which ones are still alive and whether someone used them, and from which IP; sudo lnkstart server share revoke throws out whoever entered with one at once. Only for protected web services: without a password or token there is nothing to skip. With alerts set, you get one each time someone enters with a link.
When your machine is not there
If the agent or app do not respond, the visitor sees a page saying the service is back soon (code 503), never a server error. Once the agent returns, the next visit gets through.
That page, and the redirect below, are for browser navigations: an API call gets a 503 with JSON ({"success": false, "error": "service_unavailable"}) instead, which is what a client can read.
On your machine
lnkstart add app=3000 --fallback https://status.mydomain.com
With --fallback, instead of that page the visitor is sent to the address you give.
Your main domain and your subdomains
The usual setup: the website on your domain and the API on a subdomain, each on a port of the same machine. The server looks at the domain the visitor is asking for and sends it to the right port, like an nginx server_name.
On your machine
lnkstart add tunnels.midominio.com=3000 api=8080 --app web
tunnels.midominio.com serves your website and api.tunnels.midominio.com your API. Each one gets its own certificate.
Multiple apps on one machine
With --app everything is grouped in services.toml, this machine's own file. You can edit it by hand, and it never stores a password: that lives on the server.
~/.config/lnkstart/services.toml
[web] "tunnels.midominio.com" = 3000 api = 8080 [home] nas = { port = 5000, host = "192.168.1.20" } camera = { port = 8554, tcp = "private" }
On your machine
lnkstart up lnkstart up web lnkstart down home lnkstart down nas lnkstart reload
up publishes everything that is not down; down shuts down a whole app or a single service without losing what is saved, and up with the same name publishes it again (with the service installed, it hands it to the service). If you edit services.toml by hand, reload checks it and hands it to the installed service without cutting what it serves.
A domain other than your own
A domain that does not hang off tunnels.midominio.com (store.example.com) is authorized by the server owner, machine by machine. Its DNS has to point to the VPS, and the server does not need restarting.
On the VPS
sudo lnkstart server join-code laptop --domains store.example.com sudo lnkstart server token domains add laptop other.example.com
The first, when creating the machine; the second, to add one later.
On your machine
lnkstart add store.example.com=3000