hawse publishes TCP and UDP services on a server's ports. The client opens one
outbound QUIC connection to the server, so the network holding the services
needs no inbound connectivity: no port forwarding, no public address, no
firewall rules for incoming traffic.
The server listens on the configured ports and relays what arrives on them over
that connection, to an address the client can reach. It needs an address that
its clients and their visitors can reach, which is usually a public one but does
not have to be.
Both ends authenticate with Ed25519 keys inside TLS 1.3. The client pins the
server's public key. The server holds a list of client keys and the ports each
client may bind.
What it is for
Working today, with TCP and UDP forwarding and key-based authorization:
- Reaching machines you cannot port-forward into. A home server behind
CGNAT, a build machine on a corporate network, a Raspberry Pi at a relative's
house. Each machine holds its own key, and the server grants it specific
ports.
- SSH without a shell account on the relay. The usual alternative is
autossh -R, which needs an account on the public box and reconnects only as
well as the wrapper around it. Here the public server never gets shell access,
and reconnection is part of the client.
- Self-hosted web services. Expose the service on a public port and put a
reverse proxy such as Caddy or nginx in front of it on the server for TLS and
a hostname. hawse forwards bytes and does not read HTTP.
- Webhooks and demos during development. Give a payment provider or a
colleague a stable address that lands on a laptop.
- A doorway into one network. Since
local can name any host the client
reaches, a single client can publish services running on several machines
beside it.
- Databases and admin interfaces.
allow limits a service to the networks
you list, and the server turns everyone else away. See
Configuration.
- Networks that block outbound UDP. When QUIC does not connect, the client
carries the tunnel over TLS instead, and
transport.prefer = "tcp" asks for
that outright.
- A client that changes network. Over QUIC a session follows its client to
a new address, and the connections open through it carry on.
- WireGuard, DNS, and game servers.
port = "51820/udp" exposes a UDP
service. Read the note on UDP under
Configuration first: a
payload too large for one QUIC datagram is carried differently.
Waiting on features that are not implemented yet:
- Many HTTPS services on one port 443 need SNI routing.
Status
TCP and UDP forwarding work, with fixed or dynamically assigned public ports.
0.5.0 changed the wire format. A 0.5.0 end does not talk to an older one, and a
0.5.0 client says so when it meets one: upgrade the server and its clients
together.
Besides the features named above, the expose subcommand is not implemented
either.
The issues list everything that
is planned or deliberately deferred.
Install
Each release has a static binary
for x86_64, aarch64 and armv7 Linux, and one for Apple Silicon macOS. The archive
holds the binary, its licenses, THIRD-PARTY-LICENSES.txt for the crates
compiled into it, and the systemd units from contrib/.
install.sh picks the archive for the machine it runs on from the latest
release, checks it against SHA256SUMS and installs the binary to
/usr/local/bin:
curl -fsSL https://raw.githubusercontent.com/andriykohut/hawse/main/install.sh | sh
The documentation has the other ways to
install it, and usage,
configuration and
logging.
License
Licensed under either of
at your option.
Contribution
Unless you explicitly state otherwise, any contribution intentionally submitted
for inclusion in the work by you, as defined in the Apache-2.0 license, shall be
dual licensed as above, without any additional terms or conditions.
