client.toml.example

# flextunnel client config (TOML).
#
# Load with:  flextunnel client start -c client.toml
#         or: place it at ~/.config/flextunnel/client.toml, where it is loaded
#             automatically when `client start` is run with any other flag
#             (e.g. `flextunnel client start --socks-port 1080`). A bare
#             `client start` with no arguments prints help; `--quick` ignores
#             this file entirely — it prompts for the connection details and
#             runs a self-contained live panel in the terminal (no config, no
#             lock, no control socket; quitting disconnects).
#
# CLI flags override these values. Unknown keys are rejected.

# EndpointId of the server to connect to (from `flextunnel show-iroh-id`).
# Also the client's identity: its prefix keys the single-instance lock and the
# control socket, so one client runs per server (per user) and `flextunnel
# client control` finds it from this config.
server_node_id = "<server endpoint id>"

# Optional friendly name for this profile, shown in the control panel and
# statuses. Display-only.
# name = "aws"

# Optional local SOCKS5 listener port. Unset means disabled. Listeners bind
# 127.0.0.1 only (they are unauthenticated, so they are never exposed beyond
# this machine — same as the desktop client).
# socks_port = 1080

# Optional HTTP proxy listener port (CONNECT + absolute-URI plain-HTTP
# forwarding). Unset means disabled. With neither socks_port nor http_port
# set, the client runs in port-forward-only mode (see [[forwards]] below).
# http_port = 8081

# This client's authentication keypair — always a key file (generate with
# `flexaccess-keys generate-auth-key -o ~/.config/flextunnel/client.key`;
# put its public entry, from `flexaccess-keys show-auth-key
# --private-key-file ~/.config/flextunnel/client.key`, on the server's
# authorized_keys_file). There is no inline variant in the config;
# `--auth-key` exists only as a CLI flag.
auth_key_file = "~/.config/flextunnel/client.key"

# Optional iroh tuning and reconnect behavior.
# Custom relay(s) for failover. Configuring custom relays disables n0 internet
# discovery (pkarr/DNS) — the peer is reached via relay hints instead; mDNS
# local-network discovery stays on. relay_auth_token is an optional shared bearer
# token sent to every custom relay's WebSocket upgrade; it is only valid with
# custom relay_urls (rejected with the default iroh relays).
# relay_urls = ["https://relay.example"]
# relay_auth_token = "shared-relay-secret"
# auto_reconnect = true                      # default: true. set false to exit on the first failed attempt or drop
# max_reconnect_attempts = 10                # default: unlimited (omit for no cap). retries before giving up

# The split-tunnel routed set (the "tunnel set") is configured on the server and
# pushed to this client during the handshake — there is no client-side routed-set
# config. See server.toml.example.

# Server-direct port forwards: each `[[forwards]]` table listens on
# localhost:<local_port> (127.0.0.1/::1 only) and opens a stream to
# <remote_host>:<remote_port> on the authenticated server connection. The
# server enforces its routed set and resolves the host (host aliases apply),
# so the remote must be covered by the server's tunnel set. Forwards are
# declared here only — the control panel (`flextunnel client control`) shows
# their state but cannot change them; edit this file and restart the client
# instead. A forward whose local port cannot bind is switched off with the
# reason shown next to its row. Local ports must be unique and nonzero. label
# is optional (display only).
#
# Unlike `ssh -L`, the server's loopback is NOT reachable by default: a
# loopback remote must be on the server's routed set too. `127.0.0.1`/`::1`
# need a loopback CIDR in routed_cidrs (e.g. "127.0.0.0/8", "::1"), while
# `localhost` is a hostname and needs "localhost" (or "*") in routed_domains.
# Otherwise the server rejects the stream ("connection not allowed").
# [[forwards]]
# label = "local-web"
# local_port = 8080
# remote_host = "127.0.0.1"   # needs "127.0.0.0/8" in the server's routed_cidrs
# remote_port = 80
#
# [[forwards]]
# label = "db"
# local_port = 5432
# remote_host = "db.internal"
# remote_port = 5432
#
# [[forwards]]
# local_port = 8443
# remote_host = "10.0.0.7"
# remote_port = 443