Nora

Webhooks, preview links and WebSocket clients need a public HTTPS address, and hosted tunnels hand out addresses that change or put traffic through someone else's service. I wanted a stable https://NAME.nora.davblu.dev for any app running on my machine, relayed through my own VPS, with access limited to people I invite.

Nora is a Go CLI and a relay server. The CLI opens one outbound WebSocket to the relay and carries yamux streams over it, one HTTP exchange per stream. Request and response bodies are streamed, never buffered whole, and a WebSocket upgrade switches its stream to opaque duplex bytes, so large downloads, server-sent events and long-lived sockets pass through unchanged. One session holds a name at a time and is never displaced, reconnects use capped backoff with jitter, and a reservation survives disconnects and server restarts in SQLite.

Access is by single-use invitation, with a separately revocable token per device that never appears in URLs, logs or project files; control-plane access logs are off so invitation codes are never recorded. A reservation also owns every name one level beneath it: the relay obtains a *.NAME certificate from Let's Encrypt through Cloudflare DNS-01 and Traefik passes those connections through by SNI, so apps that pick a tenant from the Host header work without custom domains. A project file can route nested names or path prefixes to different local ports.

The relay runs at nora.davblu.dev on my own VPS, deployed with Docker Compose behind the shared Traefik. GitLab CI validates every push with the race detector, releases the CLI with GoReleaser, publishes the downloads and deploys. The CLI installs with one checksum-verified command on Linux, macOS and Windows. The source is private; releases and install scripts are public.