GitHub - MaticianInc/portal: A network service for securely connecting to your device from anywhere · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
Uh oh!
There was an error while loading. Please reload this page.
MaticianInc
portal
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Folders and files<br>NameNameLast commit message<br>Last commit date<br>Latest commit
History<br>131 Commits<br>131 Commits
.github/workflows
.github/workflows
cf
cf
crates
crates
.gitignore
.gitignore
README.md
README.md
View all files
Repository files navigation
Matic Portal
This provides a toolkit for securely making connections between two computers anywhere in the world.
The service is made up of 3 components:
Router: a cloud service that routes traffic between a host and a client.
Host: a program that wants to allow clients to connect remotely.
Client: a program that wants to connect to a host.
A connection to the router uses a websocket over https. So the connection between the host and router<br>and the connection between the client and router are secured by TLS. It is recommended that the tunnelled<br>connection (between client and host) also use another layer of security (e.g. TLS) to ensure that the router<br>cannot observe or tamper with the communications between host and client.
The host and client need to supply a cryptographically signed token to prove that they are permitted to
connect to this router
offer a portal with a specific unique ID (host)
connect to a portal with a specific unique ID (client)
The router validates the token. A sample program for generating tokens is provided, but it's assumed that<br>the production tokens are generated by another service that's not included here. The portal id must be<br>unique to the host, but has no inherent meaning: it's just an identifier used to help the router connect a<br>client to the expected host. The client token will only open a connection to the host possessing the token<br>for the same portal id.
The router is designed to run on CloudFlare workers, using hibernatable websockets so that an idle connection<br>doesn't consume any resources. This requires a paid CloudFlare account. A demo server is provided for local<br>experimentation, but the demo server can't do websocket hibernation so every open socket consumes server<br>resources.
Deploying the service to cloudflare:
These steps require Wrangler, npm, worker-build 0.1.2 and wasm-pack.
Testing with Wrangler
Set the jwt token secret:
' >.dev.vars">$ cd cf/<br>$ echo 'jwt_secret=' >.dev.vars
Run the router:
$ cd cf/<br>$ npx wrangler dev
Running the "echo" host and client
Create a token for the echo host:
--days 1 ">$ cargo run --example make-token -- --role host --portal-id 1234 --secret --days 1
With that host token in the environment, run the echo host:
$ RUST_LOG=debug cargo run --example echo-host -- --server ws://localhost:8787
Create a token for the echo client:
--days 1 ">$ cargo run --example make-token -- --role client --portal-id 1234 --secret --days 1
With that client token in the environment, run the echo client:
$ RUST_LOG=debug cargo run --example echo-client -- --server ws://localhost:8787
Running the TCP forwarding host and client
Create a host and client token as above. Then run the host and client as follows:
Run a host that offers to tunnel connections to myserver port 80:
--target-port 80">RUST_LOG=debug cargo run --example tcp-forward -- --server ws://localhost:8787 --service my_tcp_service --reconnect host --target-host --target-port 80
Run a client that opens a local port 8000 and proxies data through the tunnel.
RUST_LOG=debug cargo run --example tcp-forward -- --server ws://localhost:8787 --service my_tcp_service --reconnect client --port 8000
Deploying to CloudFlare
If you need to reset the portal secret:
$ npx wrangler secret put jwt_secret
Deploy the router:
$ cd cf/<br>$ npx wrangler deploy
The host and client programs will work the same way, except you will need to specify the real URL, e.g. wss://portal-router.your-account.workers.dev.
Copyright and license
Code in crates/ is (C) 2024 Matic Robots, Inc. and is distributed under the Apache-2.0 license.
About<br>A network service for securely connecting to your device from anywhere<br>maticrobots.com/<br>Resources<br>Readme<br>Activity<br>Custom properties<br>Stars<br>9 stars<br>Watchers<br>1 watching<br>Forks<br>1 fork<br>Report repository
Releases
Contributors
Languages
You can’t perform that action at this time.