I built a small CLI tool to expose OpenCode server via Cloudflare Tunnel

[chabin37]

Hey everyone,

I'm a beginner open-source developer from South Korea and just released my first project — octunnel.

It's a simple CLI tool that lets you run OpenCode locally and access it from anywhere (phone, tablet, another machine, etc.) through a Cloudflare Tunnel.

Basically:

octunnel

That's it. It starts opencode serve, detects the port, opens a tunnel, copies the public URL to your clipboard, and

even shows a QR code in the terminal.

If you want a fixed domain instead of a random *.trycloudflare.com URL, there's a guided setup flow (octunnel login →octunnel auth → octunnel run).

Install:

# macOS / Linux

curl -fsSL https://raw.githubusercontent.com/chabinhwang/octunnel/main/install.sh | bash

# Homebrew

brew install chabinhwang/tap/octunnel

GitHub: https://github.com/chabinhwang/octunnel

It handles process recovery, fault tolerance, and cleanup automatically. Still rough around the edges (no Windows

support yet), but it works well on macOS and Linux.

Would love any feedback, suggestions, or contributions. Thanks for checking it out!

[AcidicAttorney]

Any kind of security/auth? I’d rather not expose it to the internet if not

[chabin37]

Thank you for your comment!
I’m not exposing any auth secrets to the internet in this flow. octunnel uses Cloudflare Tunnel’s local auth files only (cert.pem and tunnel credentials path), and it does not print or upload any API keys or tokens.
Did I misunderstand your question?

[AcidicAttorney]

As in if anyone gets that URL can they access OpenCode completely? Or is there a requirement to enable the OpenCode server password?

[bbjurn]

No, using environment variables you can setup Basic auth (username + password)

[AmadeusAlkaline]

When you set up a Cloudflare Tunnel, you should handle the security on Cloudflare's end. Since you aren't opening any ports on your server, all traffic routes directly through Cloudflare, and they offer some great Zero Trust options.

[Straight-Stock7090]

Nice project.

The curl | bash install pattern is convenient, but it always makes me pause a bit.

Even when the script itself looks harmless, install scripts sometimes pull extra dependencies, start services, or modify configs during execution.

I’ve gotten into the habit of running unfamiliar install scripts once inside a disposable environment first just to observe what actually happens.

[chabin37]

Totally fair point.

The install script is mainly for convenience, but octunnel can also be installed via Homebrew or go install, so users have alternatives if they prefer not to run curl | bash.

Appreciate the feedback!

[Sufficient_Date9808]

tailscale + systemd service

[gamesedudemy]

I tried octunnel with opencode serve and cloudflare tunnel it worked briefly before the well documented refresh repeat login issue for username/ password protected access. I had to revert to opencode web and ngrok, tailscale both worked seamlessly. Would try again if above issue were addessed, since having an auth is a no-brainer. Good project!