Explita InfraExplita Infra
Tunnel

Overview

High-performance, open-source reverse tunnels with inner session encryption and local wire inspection

Explita Tunnel (eta)

Explita Tunnel is an open-source, developer-first reverse tunneling gateway and client suite. It lets you expose local development web servers, webhooks (Stripe, GitHub, Shopify, Paystack), and duplex WebSockets to the public internet securely without opening firewall ports or configuring router NAT.

Unlike legacy tunneling services that inspect or store your unencrypted payloads on remote servers, Explita Tunnel uses an inner cryptographic envelope (ECDH P-256 + AES-256-GCM) directly between the gateway and your local workstation, executing all traffic inspection strictly inside your local memory.

⚡ Key Highlights

Open Source & Self-Hostable

Deploy your own high-throughput edge gateway with Fastify, Caddy, and Docker.

Inner Tunnel Cryptography

Authenticated ECDH + AES-256-GCM encryption secures payloads between gateway and local agent.

Modular Auth & Telemetry Plugin

Plug-and-play email OTP authentication, Prisma/PostgreSQL token tracking, and metrics.

Zero-Log Local Inspector

Stream and replay HTTP requests locally on port 39755 without cloud payload retention.

Multi-Tenant SaaS Routing

Test multi-tenant applications using -- delimiter syntax under single-level wildcard TLS.

Feature-Rich CLI (eta)

Shorthand binary with persistent subdomains, CIDR firewalling, and config file support.

🏗️ Architecture

Explita Tunnel separates the transport layer (TLS 1.3 WebSocket) from the payload layer (authenticated AES-256-GCM):

Local Machine                                           Public Edge Gateway
┌────────────────────────┐                             ┌───────────────────────────────┐
│ Local Web Application  │                             │ Inbound Client (Browser/Hook) │
│ (e.g. Next.js on 3000) │                             │ https://myapp.tunnel.infra... │
└───────────▲────────────┘                             └───────────────▲───────────────┘
            │                                                          │
     HTTP / WebSocket                                            HTTPS / WSS
            │                                                          │
┌───────────▼────────────┐     ECDH P-256 + AES-256-GCM        ┌───────▼───────────────────────┐
│ eta Client CLI Agent   │◄───────────────────────────────────►│ Explita Tunnel Server         │
│ (Inspector on :39755)  │        (Encrypted Frames)           │ (Fastify + HostRouter)        │
└────────────────────────┘                                     └───────────────────────────────┘
  1. Client Handshake: When you run eta 3000, the CLI establishes a persistent WebSocket connection to the gateway server (/_connect).
  2. Key Agreement: Both peers exchange ephemeral P-256 elliptic curve public keys and compute a shared secret via HKDF-SHA256.
  3. Fingerprint Verification: Both sides calculate and print matching key fingerprints (SHA256:xx:xx:...) to verify the encrypted channel.
  4. Proxy & Stream: Inbound public traffic hits the gateway, gets packaged into encrypted binary/JSON frames, and streams to your workstation for local decryption and forwarding.

🚀 Quickstart

1. Install the CLI

Install the official Explita CLI globally via your preferred package manager:

pnpm add -g @explita/cli
# or: npm install -g @explita/cli
# or: yarn global add @explita/cli

Verify your installation:

eta --help

2. Expose a Local Port

Start your local application (e.g. Next.js, Vite, Express, or Django on port 3000), then launch the tunnel:

eta 3000

The CLI outputs:

  • Public Tunnel URL: https://random-id.tunnel.explita.ng
  • Session Fingerprint: SHA256:4b:92:ef:...
  • Local Web Inspector: http://127.0.0.1:39755

3. Claim a Fixed Subdomain

To prevent webhook URLs from breaking every time you reconnect, specify a custom subdomain:

eta 3000 -s my-webhook-receiver
# -> https://my-webhook-receiver.tunnel.explita.ng

🛡️ Zero-Log Privacy Commitment

Most commercial tunneling services route your traffic through shared cloud infrastructure where request headers, authorization cookies, and database payloads can be logged or monitored.

Explita Tunnel operates on a zero-log principle:

  • No Payload Disk Logging: Request and response bodies are streamed through volatile Node.js buffer memory and immediately discarded upon delivery.
  • Local-Only Observability: The request inspector dashboard runs on 127.0.0.1:39755 on your machine. Your requests never touch an external monitoring database.
  • Header Sanitization: Gateway servers automatically strip caller-supplied x-explita-* headers to avoid internal spoofing while passing verified client IP metadata to your app.

📚 Explore the Documentation

Continue reading to configure and deploy Explita Tunnel:

Global CLI Reference

Reference documentation for shared commands, global configuration, and shell completion across the unified Explita CLI

Self-Hosting Guide

Step-by-step instructions to self-host and deploy your own Explita Tunnel edge gateway

On this page

Explita Tunnel (eta)⚡ Key Highlights🏗️ Architecture🚀 Quickstart1. Install the CLI2. Expose a Local Port3. Claim a Fixed Subdomain🛡️ Zero-Log Privacy Commitment📚 Explore the Documentation