Enrol and run

The install script does this for you. Use these commands when you install by hand or automate it.

Enrol

printf '%s' 'fpt_…' | flowplane-tunnel enroll -console https://api.flowplane.eu -token-stdin

The one-time token comes from Settings › Tunnels › Add tunnel and is valid for a day. If enrolment fails, create a new command in the console and try again.

Run

flowplane-tunnel run -allow 10.0.0.0/24 -allow homeassistant.lan:8123

Keep it running with systemd, launchd, or whatever your machine uses. Within half a minute, the tunnel shows Connected in the console.

Commands

Command
enroll	Enrol with a one-time token.
run	Connect and serve calls.
renew	Renew the tunnel’s credentials now. Restart a running tunnel afterwards.
version	Print the version.

Flags

Flag	Commands
-allow ENTRY	run	What the tunnel may reach. Repeat it. See the allow list.
-dir DIR	all	The state directory. Default /var/lib/flowplane-tunnel, or FLOWPLANE_TUNNEL_DIR.
-console URL	enroll, run	The console API, https://api.flowplane.eu.
-token-stdin	enroll	Read the one-time token from standard input.
-token-file FILE	run	First start only: enrol with the token in this file. Useful for a mounted secret.
-debug	run	Log every connection.

The state directory

It holds the tunnel’s credentials. Keep it private: out of Git, images and shared backups, and never copy it to another machine. If it is lost or may have been copied, use Disconnect in the console and enrol again.

Removing a tunnel

You can remove a tunnel in the console at any time. Apps that used it stop until you choose another tunnel.