Installation

Install the client

Curl installer (recommended)

curl -fsSL https://get.hle.world | sh

Installs via pipx (preferred), uv, or pip-in-venv. To pin the current release:

curl -fsSL https://get.hle.world | sh -s -- --version 2611.3

To also enroll the machine as an agent and run it as a service that starts at boot:

curl -fsSL https://get.hle.world | sh -s -- --agent

pipx

pipx install hle-client

Homebrew

brew install hle-world/tap/hle-client

Update the client

Re-running the installer upgrades in place:

curl -fsSL https://get.hle.world | sh

It detects the existing install and hands off to hle update, so this is the same upgrade as running the command explicitly:

hle update

hle update works out where the client lives — pipx, uv, a venv, Homebrew, plain pip — and runs the right upgrade. Either way it rebuilds any services installed on the machine against the new client and restarts them, because a service started before the upgrade is still running the old code while hle version reports the new one.

To look before you leap, or to pin a version:

hle update --check
hle update --version 2611.3

To force the old from-scratch build — the installer deletes the environment and recreates it — pass --reinstall:

curl -fsSL https://get.hle.world | sh -s -- --reinstall

You rarely want this; prefer the upgrade. The installer falls back to the from-scratch rebuild on its own if the in-place upgrade fails.

Those predate the installer’s in-place hand-off, so it can fall back to the from-scratch build there. Upgrade once with the tool that installed the client:

pipx upgrade hle-client   # or: pip install -U hle-client

Then rebuild the services against the new client:

hle daemon refresh --all

If a client was upgraded some other way — a package manager, a restored backup — the services on the machine can be left describing the old one. Rebuild them without touching the client:

hle daemon refresh --all

Run it as a service

To keep a tunnel (or the agent) running across reboots, install a systemd unit or launchd job:

# The dashboard-managed agent — all endpoints in one service
hle daemon install agent

# Or a single fixed tunnel
hle daemon install tunnel ha http://localhost:8123

Scope is auto-detected: as root you get a system service that starts at boot, as a normal user you get a per-user one. Force it with --system or --user. Credentials are read at runtime from ~/.config/hle/ and never written into the service file.

Manage it with hle daemon status, hle daemon list, and hle daemon uninstall. See the agent guide for logs and troubleshooting.

Get an API key

Sign up at hle.world/register
Go to Dashboard > Keys
Click “New API Key” and copy the key

Expose a service

hle tunnel create http://localhost:8123 --api-key hle_your_key

Your service is now accessible at https://<label>-<code>.hle.world

Save your API key

To avoid passing --api-key every time, set the environment variable:

export HLE_API_KEY=hle_your_key

Or save it permanently in your shell profile (~/.bashrc, ~/.zshrc, etc.).

The client also stores your key in ~/.config/hle/config.toml after the first successful connection.

Docker

Run the HLE client as a Docker container:

docker run -d --name hle-tunnel \
  -e HLE_API_KEY=hle_your_key \
  ghcr.io/hle-world/hle-client:latest \
  tunnel create ha http://host.docker.internal:8123

Kubernetes sidecar

Run the HLE client as a sidecar container alongside your app:

containers:
  - name: my-app
    image: my-app:latest
    ports:
      - containerPort: 8080
  - name: hle-tunnel
    image: ghcr.io/hle-world/hle-client:latest
    env:
      - name: HLE_API_KEY
        valueFrom:
          secretKeyRef:
            name: hle-credentials
            key: api-key
    command: ["hle", "expose", "--service", "http://localhost:8080", "--label", "myapp"]

Licensing

The HLE client is MIT-licensed open source. You can inspect the code, build from source, and verify that nothing shady happens with your traffic. The relay server at hle.world is a managed service.