Self-host Tunnet
v0.9.1Open-source mesh VPN with tunnels, SSH, and Kubernetes
- Stars
- 223
- Ports
- 8080 (Agent WebSocket connections), 3000 (Management API), 9091 (Control plane admin API (internal)), 9090 (Control plane metrics (internal))
- Requires
- PostgreSQL
What is Tunnet?
Tunnet is an open-source mesh networking platform that connects machines into a private encrypted network anywhere. It provides a self-hosted stack with several server components and a web dashboard, plus optional edge and relay servers. The platform combines mesh VPN, public HTTPS tunnels, internal service exposure, peer-to-peer file transfer, identity-based SSH with session recording, device posture checks, and a Kubernetes operator under one identity and ACL system. Two modes exist: Managed for teams and Direct for individuals. The agent runs on Linux, macOS, and Windows. Self-hosting uses Docker Compose with PostgreSQL; the control plane listens on port 8080. Licensing is component-level: MPL-2.0 for agent/SDKs, AGPL-3.0-only for control plane/dashboard, Apache-2.0 for common code, with a commercial license option for AGPL components.
Should you self-host Tunnet?
Tunnet scores 46/100 on selfhost.directory (how scoring works) and ranks #42 of 56 in VPN. It has 223 GitHub stars.
It shipped 10 stable releases in the past year. The latest, v0.9.1, came out on 2 September 2026.
Setup is advanced: plan for several services and some ongoing maintenance. It is Other-licensed and written mostly in Rust.
Its closest alternative on selfhost.directory is headscale (82/100, 45 138 stars). It scores higher overall, so compare the two before you pick. See Tunnet vs headscale side by side.
Features
- Audit Logs
- Device Posture
- Direct Mode (Zero-Server P2P)
- Embeddable SDKs
- Go Management SDK
- Identity-based SSH
- Internal Service Exposure (Serve)
- Kubernetes operator
- Mesh VPN
- Peer-to-Peer File Transfer (Send)
- Policy as Code
- Public HTTPS Tunnels
- Self-hosted relay
- SSO/OIDCManaged mode only
- Web DashboardManaged mode only
Tunnet README
More in Kubernetes
woodpecker-ciSelf-hosted, open-source Apache-2.0 CI/CD engine: pipeline steps run in Docker containers and workflows trigger from forges like GitHub, Gitea, GitLab or Bitbucket.
Zero to JupyterHub with KubernetesOpen-source Helm chart and guide for self-hosting JupyterHub on Kubernetes, enabling scalable multi-user notebook environments for teams and classrooms.
Aerokube MoonMoon is a self-hosted commercial browser automation platform for Kubernetes/OpenShift running Selenium, Playwright, Cypress, and Puppeteer tests.
agenttierAgentTier is a self-hosted Kubernetes platform providing isolated sandboxes for AI agents and developers with browser terminals and gVisor isolation.
apl-coreApp Platform for Linode Kubernetes Engine
Argo CDOpen-source, self-hosted GitOps CD for Kubernetes that keeps clusters in sync with Kustomize, Helm, Jsonnet or YAML manifests in Git, with web UI, CLI, SSO and RBAC.
CanineOpen-source, self-hosted PaaS that runs on your own Kubernetes cluster: git-push deploys, Let's Encrypt SSL, rollbacks, workers and cron jobs, team access control.
carto-selfhosted-helmCARTO Self-Hosted is a commercial geospatial analytics platform deployed on Kubernetes via Helm, keeping sensitive data within your network for compliance and security.
cloudflare-tunnel-ingress-controllerOpen-source, self-hosted Kubernetes Ingress Controller that exposes Services through Cloudflare Tunnel, automating tunnels, DNS records and cloudflared connectors.
CompartmentCompartment is a self-hosted, open-source Kubernetes deployment platform for teams to run internal tools and apps on their own infrastructure with SSO and RBAC.
ctkSelf-hosted, open-source tool to design Docker Compose and Kubernetes configs visually in the browser, with AI agent help via MCP.
DexOpen-source, self-hosted OIDC and OAuth 2.0 identity service that fronts LDAP, SAML, GitHub, Google and other IdPs, so every app just speaks OpenID Connect.
0 comments