Three problems, one relay.
The shape is always the same — something on your network, something outside it, and no port in between. What changes is what you're reaching and how permanent it needs to be.
Your house, from your phone.
Home Assistant, Jellyfin, Plex, Grafana, Pi-hole. Browser-based access with SSO in front, WebSockets intact so dashboards stream in real time, and no VPN client to install on a phone that's already low on battery.
Install an agent on the box that can see everything
Usually the NAS, the Pi, or whatever's already running Docker. One agent covers every service on that network — the target is any URL the agent can reach.
Declare an endpoint per service
Label, local URL, SSO on. ha becomes ha-x7k.hle.world with a real certificate.
Share with the household by email
Add the people who should get in, one address at a time. Everyone else gets a login screen and no further.
A typical homelab agent
| ha | Home Assistant · SSO |
| jelly | Jellyfin · SSO |
| grafana | Grafana · SSO |
| pihole | Pi-hole admin · SSO |
| ssh | Firepuncher · port 22 |
Why not a VPN?
A VPN is all-or-nothing and needs a client on every device. Per-service URLs with SSO let you hand someone Jellyfin without handing them your whole network.
Proxmox, Unraid, TrueNAS, a cluster in the basement.
Once you're running real infrastructure, the web UI is only half of it. You also need SSH into the hypervisor, psql against the database, and RDP into that one Windows VM — none of which a browser tunnel can carry.
One agent per machine
Each box gets its own agent and its own allowlist, so a compromised laptop credential can't reach further than the rules you wrote.
Let discovery do the inventory
An agent inside Kubernetes or on a Docker host lists what it can see. Pick a service and it becomes an endpoint — no hostname to look up.
Firepuncher the rest
SSH, Postgres, Redis, RDP, VNC. A local port that is really a port inside the network.
Reaching things that aren't HTTP
# hypervisor shell $ hle fp --agent pve --to 22 # postgres on the LAN $ hle fp --agent pve --to 10.0.0.9:5432 $ psql -h 127.0.0.1 -p 14432 # that one windows vm $ hle fp --agent pve --to 10.0.0.24:3389
Share the thing you haven't deployed yet.
A URL that works, pointing at the code running on your laptop right now. Good for a client demo, a design review, pair debugging, or receiving webhooks you can actually breakpoint.
Expose the dev server
One command, no agent needed. Stops when you press Ctrl+C.
Point the webhook at it
Stripe, GitHub, Shopify — give them the HLE URL and debug the payload locally instead of guessing from logs.
Gate it if it's not ready
Add SSO and an email allowlist so a half-built app isn't sitting open on the internet.
Quick share
$ hle expose --service http://localhost:3000 --label preview ✓ Live at https://preview-x7k.hle.world
Only your team
$ hle expose --service http://localhost:3000 \ --label staging \ --allow google:you@acme.io \ --allow google:teammate@acme.io
--allow is repeatable and additive — one rule per person. Prefix with google:, github: or hle: to require a specific sign-in method.
Which one do I want?
| I want to… | Use |
|---|---|
| Share a web app for the next ten minutes | hle expose |
| Keep five homelab services reachable forever | An agent |
| SSH into a box behind NAT | Firepuncher |
Run psql against a database at home | Firepuncher |
| Receive webhooks on my laptop | hle expose |
| Expose something already running in Kubernetes | An agent + discovery |
Whichever one you are, it's free to find out.
Two gigabytes a month, no card, no trial clock.