Skip to content
HLE
Login

Installation

Install the client

Terminal window
curl -fsSL https://get.hle.world | sh

Installs via pipx (preferred), uv, or pip-in-venv. To pin the current release:

Terminal window
curl -fsSL https://get.hle.world | sh -s -- --version 2609.6

To also enroll the machine as an agent and run it as a service that starts at boot:

Terminal window
curl -fsSL https://get.hle.world | sh -s -- --agent

pipx

Terminal window
pipx install hle-client

Homebrew

Terminal window
brew install hle-world/tap/hle-client

Update the client

One command, whichever way you installed it:

Terminal window
hle update

It works out where the client lives — pipx, uv, a venv, Homebrew, plain pip — and runs the right upgrade. Then it rebuilds any services installed on the machine against the new client and restarts them, because a service started before the upgrade is still running the old code while hle version reports the new one.

To look before you leap, or to pin a version:

Terminal window
hle update --check
hle update --version 2609.5

If a client was upgraded some other way — a package manager, a restored backup — the services on the machine can be left describing the old one. Rebuild them without touching the client:

Terminal window
hle daemon refresh --all

Run it as a service

To keep a tunnel (or the agent) running across reboots, install a systemd unit or launchd job:

Terminal window
# The dashboard-managed agent — all endpoints in one service
hle daemon install agent


# Or a single fixed tunnel
hle daemon install tunnel ha http://localhost:8123

Scope is auto-detected: as root you get a system service that starts at boot, as a normal user you get a per-user one. Force it with --system or --user. Credentials are read at runtime from ~/.config/hle/ and never written into the service file.

Manage it with hle daemon status, hle daemon list, and hle daemon uninstall. See the agent guide for logs and troubleshooting.

Get an API key

  1. Sign up at hle.world/register
  2. Go to Dashboard > Keys
  3. Click “New API Key” and copy the key

Expose a service

Terminal window
hle tunnel create http://localhost:8123 --api-key hle_your_key

Your service is now accessible at https://<label>-<code>.hle.world

Save your API key

To avoid passing --api-key every time, set the environment variable:

Terminal window
export HLE_API_KEY=hle_your_key

Or save it permanently in your shell profile (~/.bashrc, ~/.zshrc, etc.).

The client also stores your key in ~/.config/hle/config.toml after the first successful connection.

Docker

Run the HLE client as a Docker container:

Terminal window
docker run -d --name hle-tunnel \
  -e HLE_API_KEY=hle_your_key \
  ghcr.io/hle-world/hle-client:latest \
  expose --service http://host.docker.internal:8123 --label ha

Kubernetes sidecar

Run the HLE client as a sidecar container alongside your app:

containers:
  - name: my-app
    image: my-app:latest
    ports:
      - containerPort: 8080
  - name: hle-tunnel
    image: ghcr.io/hle-world/hle-client:latest
    env:
      - name: HLE_API_KEY
        valueFrom:
          secretKeyRef:
            name: hle-credentials
            key: api-key
    command: ["hle", "expose", "--service", "http://localhost:8080", "--label", "myapp"]

Licensing

The HLE client is MIT-licensed open source. You can inspect the code, build from source, and verify that nothing shady happens with your traffic. The relay server at hle.world is a managed service.