{"architectures":[{"id":"A1","name":"Dev tunnel","summary":"Single server + client exposing localhost with self-signed TLS."},{"id":"A2","name":"Production direct apex","summary":"One shared tunnel on the apex domain (-routing direct -prod)."},{"id":"A3","name":"Subdomain multi-tenant","summary":"Wildcard edge; many clients, one server."},{"id":"A4","name":"LB + barge fleet","summary":"Horizontal tunnel HA with dynamic registration (k3s default)."},{"id":"A5","name":"Product stack","summary":"Single-region k3s Deployments for hub product images."},{"id":"A6","name":"Multi-PoP + kernel mesh","summary":"Global ingresses; local embeds; real-time kernel replication peers."},{"id":"A7","name":"Anycast edge","summary":"BGP health-gated split-horizon DNS face with withdraw on failure."},{"id":"A8","name":"Vhosts + tunnels","summary":"Product apex next to user tunnel subdomains."},{"id":"A9","name":"Mesh-only private","summary":"Private TLD overlay without public barge haul."},{"id":"A10","name":"Hub image pipeline","summary":"OCI hub public pull / authed push into fleets."},{"id":"R1","name":"Resilient: HA tunnel edge","summary":"LB + ≥2 barges, heartbeats, optional snapshots."},{"id":"R2","name":"Resilient: global anycast","summary":"A6+A7 multi-PoP stack with health-gated anycast."},{"id":"R3","name":"Resilient: vhost failover","summary":"Same public hostname; cut over upstream to standby."},{"id":"R4","name":"Resilient: kernel replication","summary":"Local primary + AddPeer mesh; never prefer-remote-only."},{"id":"R5","name":"Resilient: image integrity","summary":"SDF fleet+digest attestation; public pull, authed push."}],"engine":"hub.tunneltug.com/tunneltug/engine:latest","links":{"docs":"https://github.com/TunnelTug/tunneltug/blob/main/docs/ARCHITECTURES.md","sboms":"https://hub.tunneltug.com/_tunneltug/hub/sboms","site_example":"https://github.com/TunnelTug/tunneltug/blob/main/config/site.example.yaml","tug_example":"https://github.com/TunnelTug/tunneltug/blob/main/config/site.example.tug"},"products":[{"name":"ack","display":"Ack","repo":"0trust/ack","desc":"Event and community chat — brand face defcon.chat","port":3083,"kind":"app","zero_config_port":"3083","default_links":["social","ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ack?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ack/view?tag=latest"},{"name":"bandy","display":"Bandy","repo":"0trust/bandy","desc":"General discussion chat — brand face bandy.chat","port":3084,"kind":"app","zero_config_port":"3084","default_links":["social","williwaw","ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/bandy?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/bandy/view?tag=latest"},{"name":"williwaw","display":"Williwaw","repo":"0trust/williwaw","desc":"Social feed and stories","port":3081,"kind":"app","zero_config_port":"3081","default_links":["social","ack","ultimate_db","ultimate_keystore"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/williwaw?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/williwaw/view?tag=latest"},{"name":"motionkb","display":"MotionKB","repo":"0trust/motionkb","desc":"Docs and published sites","port":8090,"kind":"app","zero_config_port":"8090","default_links":["social","williwaw","ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/motionkb?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/motionkb/view?tag=latest"},{"name":"work","display":"TodoTraq","repo":"0trust/work","desc":"Hybrid delivery boards + CRM — brand face todotraq.com","port":0,"kind":"app","zero_config_port":"","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/work?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/work/view?tag=latest"},{"name":"mail","display":"MeshMail","repo":"0trust/mail","desc":"Secure team mail","port":3086,"kind":"app","zero_config_port":"3086","default_links":["ultimate_db","ultimate_keystore"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/mail?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/mail/view?tag=latest"},{"name":"search","display":"MeshSearch","repo":"0trust/search","desc":"Private search","port":3087,"kind":"app","zero_config_port":"3087","default_links":["ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/search?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/search/view?tag=latest"},{"name":"gitmesh","display":"GitMesh","repo":"0trust/gitmesh","desc":"GitHub replacement — go-git source hosting","port":3088,"kind":"app","zero_config_port":"3088","default_links":["ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/gitmesh?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/gitmesh/view?tag=latest"},{"name":"drive","display":"0Trust Drive","repo":"0trust/drive","desc":"Private cloud files — folders, previews, CRDT multi-device sync","port":3095,"kind":"app","zero_config_port":"3095","default_links":["social","ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/drive?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/drive/view?tag=latest"},{"name":"platform","display":"0Trust Platform","repo":"0trust/platform","desc":"Full identity and control plane","port":8443,"kind":"platform","zero_config_port":"8443","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/platform?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/platform/view?tag=latest"},{"name":"services","display":"0Trust Services","repo":"0trust/services","desc":"Mesh access edge","port":8080,"kind":"platform","zero_config_port":"8080","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/services?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/services/view?tag=latest"},{"name":"social","display":"0Trust CDN","repo":"0trust/social","desc":"Media and object CDN","port":3085,"kind":"app","zero_config_port":"3085","default_links":["ultimate_db"],"sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/social?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/social/view?tag=latest"},{"name":"name","display":"0Trust Name (gTLD)","repo":"0trust/name","desc":"Public gTLD face — DoH, RDAP, registrar brand","port":8447,"kind":"platform","zero_config_port":"8447","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/name?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/name/view?tag=latest"},{"name":"dbsc_relay","display":"DBSC Relay","repo":"0trust/dbsc-relay","desc":"Device-bound session credential relay","port":8450,"kind":"edge","zero_config_port":"8450","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/dbsc-relay?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/dbsc-relay/view?tag=latest"},{"name":"anycast","display":"Anycast edge","repo":"0trust/anycast","desc":"Multi-region DNS and BGP anycast","port":9099,"kind":"edge","zero_config_port":"9099","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/anycast?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/anycast/view?tag=latest"},{"name":"orchid_ingest","display":"Orchid Sync Ingest","repo":"0trust/orchid-ingest","desc":"Log and event ingest with orchid_sync BM25","port":8451,"kind":"platform","zero_config_port":"8451","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/orchid-ingest?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/orchid-ingest/view?tag=latest"},{"name":"auth","display":"0Trust Auth","repo":"0trust/auth","desc":"Identity provider — OIDC, passkeys, sessions","port":8460,"kind":"platform","zero_config_port":"8460","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/auth?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/auth/view?tag=latest"},{"name":"iam","display":"0Trust IAM","repo":"0trust/iam","desc":"Users, roles, and admin IAM console","port":8461,"kind":"platform","zero_config_port":"8461","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/iam?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/iam/view?tag=latest"},{"name":"access","display":"0Trust Access","repo":"0trust/access","desc":"ZTNA app access gateway","port":8462,"kind":"platform","zero_config_port":"8462","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/access?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/access/view?tag=latest"},{"name":"scim","display":"0Trust SCIM","repo":"0trust/scim","desc":"SCIM provisioning plane","port":8463,"kind":"platform","zero_config_port":"8463","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/scim?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/scim/view?tag=latest"},{"name":"pki","display":"0Trust PKI","repo":"0trust/pki","desc":"Mesh CA and certificate issuance","port":8464,"kind":"platform","zero_config_port":"8464","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/pki?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/pki/view?tag=latest"},{"name":"workflows","display":"0Trust Workflows","repo":"0trust/workflows","desc":"Automation pipelines and cron","port":8465,"kind":"platform","zero_config_port":"8465","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/workflows?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/workflows/view?tag=latest"},{"name":"topology","display":"0Trust Topology","repo":"0trust/topology","desc":"Fleet and network topology","port":8466,"kind":"platform","zero_config_port":"8466","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/topology?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/topology/view?tag=latest"},{"name":"nameservice","display":"0Trust Name Service","repo":"0trust/nameservice","desc":"Private DNS / nameservice admin","port":8467,"kind":"platform","zero_config_port":"8467","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/nameservice?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/nameservice/view?tag=latest"},{"name":"servicekeys","display":"0Trust Service Keys","repo":"0trust/servicekeys","desc":"Service API keys and fleet tokens","port":8468,"kind":"platform","zero_config_port":"8468","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/servicekeys?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/servicekeys/view?tag=latest"},{"name":"vpi","display":"0Trust VPI","repo":"0trust/vpi","desc":"VPI product identity plane","port":8469,"kind":"platform","zero_config_port":"8469","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/vpi?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/vpi/view?tag=latest"},{"name":"logs","display":"0Trust Logs","repo":"0trust/logs","desc":"Log explorer and observability UI","port":8470,"kind":"platform","zero_config_port":"8470","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/logs?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/logs/view?tag=latest"},{"name":"ultimate_db","display":"Ultimate DB (kernel replication)","repo":"0trust/ultimate-db","desc":"Replication peer for service data — products keep local embeds and AddPeer /kernel/* (not prefer-remote)","port":8480,"kind":"kernel","zero_config_port":"8480","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ultimate-db?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ultimate-db/view?tag=latest"},{"name":"ultimate_keystore","display":"Ultimate Keystore (kernel replication)","repo":"0trust/ultimate-keystore","desc":"Replication peer for keystore kernel RPC — local material stays; peer via /kernel/keystore","port":8481,"kind":"kernel","zero_config_port":"8481","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ultimate-keystore?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/0trust/ultimate-keystore/view?tag=latest"},{"name":"tunneltug","display":"TunnelTug engine","repo":"tunneltug/engine","desc":"Tunnel fleet runtime image","port":0,"kind":"engine","zero_config_port":"","sbom_url":"https://hub.tunneltug.com/_tunneltug/hub/sbom/tunneltug/engine?tag=latest","sbom_view":"https://hub.tunneltug.com/_tunneltug/hub/sbom/tunneltug/engine/view?tag=latest"}],"registry":"https://hub.tunneltug.com","sbom":{"catalog":"https://hub.tunneltug.com/_tunneltug/hub/sboms","format":"CycloneDX-1.5"}}