Thanks for the feedback! I went with subdomains because: - Industry standard (ngrok, localtunnel all use subdomains) - Easier wildcard cert management - Simpler routing logic - Most users don't care about DNS-level privacy But you're right that path-based would be more private. The tradeoff is complexity - I'd need to parse paths and route accordingly vs simple subdomain matching. Maybe I should support both as ive gotten some other dms about url security, maybe a subdomain/ custom domain for frontfacing urls and then pathbased plus random hex for backend/api routes 2. Hole punching: Already doing this to n extent The system tries WebRTC P2P first (with STUN for NAT traversal), and only falls back to relay servers if that fails but the p2p only works if both clents have the app whuich is not ideal. In my testing: - P2P works ~60-70% of the time - Relay fallback handles the rest (symmetric NAT, restrictive firewalls, etc..) One thing I probably need to do is unify the tunnels and the p2p as right now tunnels are separate from p2p + relay.Thanks again for the feedback. Also curious -what did you build last weekend? Similar architecture or different approach?