Expose localhost to the internet. One binary, one command.

NFLTR.XYZ creates secure tunnels from your local services to public HTTPS URLs — no DNS, no Nginx, no firewall rules. Built for developers, homelabbers, SaaS teams shipping on-premise, and enterprise fleets. gRPC-based, AES-256 encrypted, single binary. Here's what it actually does and why I think it's worth your time. The core: a gRPC tunnel dials outbound from your machine, so it works behind NAT, CGNAT, and corporate firewalls without opening a single inbound port. TLS terminates at the edge. One binary, no runtime dependencies. For developers: share a local dev server, receive webhooks (Stripe, GitHub, Slack) with built-in HMAC verification, test OAuth callbacks, or pair-program against live local code. Multi-route support maps /api to one port and / to another through a single tunnel. For homelabbers: expose Jellyfin, Home Assistant, Nextcloud — no port forwarding, no DDNS, no router config. Works behind CGNAT out of the box. For SaaS teams: ship the agent alongside your product. Your cloud gets a stable named endpoint into the client's network — no VPN negotiation with their IT team, no firewall exceptions. Fleet tokens and label selectors let you manage hundreds of client deployments centrally. For enterprise/DevOps: 75 Prometheus metrics, audit logging on every connection, policy-based auth (mTLS → JWT → API key chain), horizontal scaling, remote kubectl access into private clusters. On trust — I know the reaction to "run this binary from the internet." Two answers: there's a WASM build for sandboxed execution, and the client is being open-sourced shortly so you can audit exactly what's dialing out before you run it. Platforms: Linux, macOS, Windows, ARM64 (Raspberry Pi to Jetson), WASM. I'm looking for honest feedback — what's missing, what's unclear, what would make you actually use this or recommend it to a client. Happy to answer anything technical in the comments. → https://nfltr.xyz