Gopher is a self-hosted, open-source version of Cloudflare Tunnel. It turns one public IP into as many as 65k public services by using L4 tunnels from your machines to the edge, rather than traditional L3 routing.
photos.yourdomain.com → router.yourdomain.com:1024 →Immich on home NAS (192.168.1.50:2283)
lab.yourdomain.com → router.yourdomain.com:1025 → Jupyter on uni wifi (10.0.10.34:8888)
vault.yourdomain.com → router.yourdomain.com:1026 → Bitwarden(192.168.56.8:8000)
---
Hi HN, I’m Alex. I built Gopher over the last seven months.
Background: Pre-2025, UCLA used to give every device and VM on eduroam a public IPv4 address (perks of “inventing the internet”, i guess). Incredibly insecure, but as a freshman in college getting into infrastructure and just having bought my first homelab node, it was an absolute blessing.
However, in 2025, they moved to NAT overnight. Instantly all of my servers I had been running for myself, my research lab, and our ACM chapter lost external access. Now the default answer would have been Cloudflare tunnels, but not only was our DNS not on CF, doing so would have involved letting Cloudflare terminate your TLS and see every byte of our traffic in plaintext, which felt like it was defeating the point of self hosting.
Hence, I built Gopher. It’s a single Go binary on a box with a public IP (ideally self-hosted, but realistically a VPS - mine’s on OCI). Origin servers dial outbound to the edge over rathole with Noise transport, so even though we have zero control over the routers (we couldn’t even get a private IP subnet… let alone public IP), we can expose service without an open port or static IP. I mean if you really tried, you could run a server on the coffee shop wifi down the street - not that I would recommend you attempt to.
Caddy on the edge handles TLS termination and L7 subdomain routing. Because the edge decrypts TLS, it can actually filter requests, there's a JS proof-of-work challenge with HMAC-signed session cookies that drop scrapers before they hit the origin, plus password-gated routes. There’s so many possibilities here; the next logical step would be caching (think CDN).
A big distinction from the self-hosted tunneling space (Tailscale, Netbird, etc) is that Gopher is targeted for public services, not private access.This is for things like a membership portal, where users can’t be expected to install a VPN just to access it - it’s zero client configuration access.
Today is the first stable release (v0.1.0). Now to be candid, while it’s been running our ACM chapter’s infra for 6 months (25 services, no incidents), I wouldn’t put it behind an SLA yet. Frankly, I’m the only contributor, and something of this scope needs more eyes and deployments before it has reached that level.
smalex-z•50m ago
Hi HN, I’m Alex. I built Gopher over the last seven months.
Background: Pre-2025, UCLA used to give every device and VM on eduroam a public IPv4 address (perks of “inventing the internet”, i guess). Incredibly insecure, but as a freshman in college getting into infrastructure and just having bought my first homelab node, it was an absolute blessing.
However, in 2025, they moved to NAT overnight. Instantly all of my servers I had been running for myself, my research lab, and our ACM chapter lost external access. Now the default answer would have been Cloudflare tunnels, but not only was our DNS not on CF, doing so would have involved letting Cloudflare terminate your TLS and see every byte of our traffic in plaintext, which felt like it was defeating the point of self hosting.
Hence, I built Gopher. It’s a single Go binary on a box with a public IP (ideally self-hosted, but realistically a VPS - mine’s on OCI). Origin servers dial outbound to the edge over rathole with Noise transport, so even though we have zero control over the routers (we couldn’t even get a private IP subnet… let alone public IP), we can expose service without an open port or static IP. I mean if you really tried, you could run a server on the coffee shop wifi down the street - not that I would recommend you attempt to.
Caddy on the edge handles TLS termination and L7 subdomain routing. Because the edge decrypts TLS, it can actually filter requests, there's a JS proof-of-work challenge with HMAC-signed session cookies that drop scrapers before they hit the origin, plus password-gated routes. There’s so many possibilities here; the next logical step would be caching (think CDN).
A big distinction from the self-hosted tunneling space (Tailscale, Netbird, etc) is that Gopher is targeted for public services, not private access.This is for things like a membership portal, where users can’t be expected to install a VPN just to access it - it’s zero client configuration access.
Today is the first stable release (v0.1.0). Now to be candid, while it’s been running our ACM chapter’s infra for 6 months (25 services, no incidents), I wouldn’t put it behind an SLA yet. Frankly, I’m the only contributor, and something of this scope needs more eyes and deployments before it has reached that level.
Video Demo: https://youtu.be/iIMS9qrRxow?si=1JsQ6I8fSeaxJ_Ip Video Install: https://youtu.be/KYpr61Ak9FE?si=Ti-7hfj9vcxjre7e GitHub: https://github.com/smalex-z/gopher Website: https://gopherden.org