| 1 | --- |
| 2 | title: What is Portal? |
| 3 | description: An introduction to Portal, a permissionless localhost tunnel and public relay system. |
| 4 | --- |
| 5 | |
| 6 | # What is Portal? |
| 7 | |
| 8 | Portal is an open-source tunnel system for publishing local services through |
| 9 | public relay servers. It is built around one boundary: **relays provide |
| 10 | transport, while your tunnel process owns the endpoint behavior**. |
| 11 | |
| 12 | That means the normal HTTPS stream path does not work like a hosted reverse |
| 13 | proxy. The relay routes by SNI and forwards the connection. Tenant TLS |
| 14 | terminates in the tunnel process on your machine, so the relay does not receive |
| 15 | tenant plaintext or session keys. |
| 16 | |
| 17 | ## Core Properties |
| 18 | |
| 19 | - **Permissionless**: no SaaS account or API key is required. |
| 20 | - **Trustless stream path**: tenant TLS terminates locally, not at the relay. |
| 21 | - **Mode-per-service transport**: use HTTPS stream, routed HTTP, raw TCP, or UDP |
| 22 | depending on the service. |
| 23 | - **Self-hostable relays**: use the public registry, explicit relay URLs, or your |
| 24 | own relay. |
| 25 | - **Relay pools and multi-hop**: keep multiple relays connected or route through |
| 26 | an ordered relay chain. |
| 27 | - **Local identity**: lease ownership is proven with a locally stored secp256k1 |
| 28 | identity and challenge signing. |
| 29 | |
| 30 | ## The Mental Model |
| 31 | |
| 32 | ```text |
| 33 | Public client |
| 34 | -> Relay transport and routing |
| 35 | -> Tunnel process on your machine |
| 36 | -> Local service |
| 37 | ``` |
| 38 | |
| 39 | The relay decides where traffic should go. The tunnel process decides what the |
| 40 | traffic means. |
| 41 | |
| 42 | For the default stream path, the tunnel process accepts the connection as a TLS |
| 43 | server and then proxies bytes to your local target. For routed HTTP mode, the |
| 44 | tunnel process runs an HTTP reverse proxy and can apply HTTP-specific behavior. |
| 45 | For raw TCP and UDP, the relay allocates public transport endpoints and forwards |
| 46 | traffic to the tunnel process. |
| 47 | |
| 48 | ## Transport Modes |
| 49 | |
| 50 | | Mode | Example | Best for | |
| 51 | |------|---------|----------| |
| 52 | | Default HTTPS stream | `portal expose 3000` | Web apps, APIs, WebSockets, gRPC over HTTP | |
| 53 | | Routed HTTP | `portal expose --http-route /api=3001 --http-route /=5173` | Multiple local HTTP services behind one URL | |
| 54 | | Dedicated raw TCP | `portal expose localhost:25565 --tcp` | Minecraft, game servers, custom TCP protocols | |
| 55 | | UDP relay | `portal expose 8080 --udp --udp-addr 19132` | UDP game servers and datagram protocols | |
| 56 | |
| 57 | ## When to Use Portal |
| 58 | |
| 59 | | Use case | Example | |
| 60 | |----------|---------| |
| 61 | | Share a dev server | Show a local branch to a teammate | |
| 62 | | Webhook development | Receive Stripe, GitHub, or Discord webhooks locally | |
| 63 | | Client demos | Publish a temporary public URL for a staging app | |
| 64 | | Multi-service app demos | Mount frontend and API services under one public URL | |
| 65 | | Home servers | Expose a Minecraft server through a relay TCP port | |
| 66 | | Edge devices | Reach a device behind NAT without opening inbound ports | |
| 67 | |
| 68 | ## What Portal Does Not Promise |
| 69 | |
| 70 | Portal's default stream mode intentionally prevents the relay from controlling |
| 71 | user HTTP responses. That is good for the trust model, but it means a public |
| 72 | multi-tenant relay should not put arbitrary user tunnels under a brand domain |
| 73 | that also carries first-party SEO value. Use a separate tunnel domain for shared |
| 74 | wildcard leases. |
| 75 | |
| 76 | ## Next Steps |
| 77 | |
| 78 | - [Getting Started](/getting-started): install the CLI and expose your first app |
| 79 | - [Concepts](/concepts): understand the trustless relay and transport model |
| 80 | - [CLI Reference](/cli-reference): commands, flags, and examples |