Skip to main content

​
Public Access & Tunnel Options

Myrm does not bundle a tunnel provider. You pick a tool that works in your region and network, obtain an HTTPS public URL, then paste it into Settings → System → Public Ingress.

​
When you need a public URL

Myrm shows outbound / inbound badges on channel cards and ingress-requirement in System settings so you know when a public URL is required.

​
China / corporate LAN

​
International

​
Setup workflow

  1. Enable WebUI password protection (System settings).
  2. Run your tunnel tool against the WebUI port (default 3000).
  3. Copy the HTTPS public URL (no trailing slash).
  4. Paste into Settings → System → Public Ingress.
  5. Click Test connectivity.
  6. Configure inbound channels or cron webhooks; refresh channel pages so webhook URLs update.

​
Example: cpolar (China)

Copy the https://….cpolar…. URL into Myrm Public Ingress.

​
Built-in Quick Tunnel (One-click)

Myrm also includes a built-in Cloudflare Quick Tunnel for instant remote access without installing external tools:
  1. Open Settings → System → Remote Access.
  2. Click Start Tunnel — a temporary HTTPS URL is generated in ~5–15 seconds.
  3. Scan the QR code with your phone to open the Mobile Hub.
Important: Quick Tunnel generates a random URL each time. Use it for quick mobile access, not for permanent webhooks. For stable webhook URLs, use the self-hosted tools above.

​
Mobile Hub

Once the tunnel is running, the Mobile Session Hub lets you:
  • View all active Agent sessions from your phone
  • Open and control a specific session with push-to-talk voice input
  • Receive real-time SSE progress updates
  • Approve HITL requests, steer, or stop tasks remotely (with success/failure toast — works even when re-attaching to an in-progress SSE stream)
Access is protected by 7 layers of security:
  1. E2EE — End-to-end encryption (NaCl Box: Curve25519 + XSalsa20-Poly1305) for all mobile traffic
  2. HMAC pair tokens — SHA-256 signed tokens with automatic TTL renewal and purpose-scoped authorization
  3. Trust Zone — 6 admission paths auto-classified into 3 trust levels; remote requests are REMOTE_EXPOSED
  4. Tool restrictions — Dangerous tools (shell, file_write, yolo_mode) automatically disabled for remote sessions
  5. Chat-scoped binding — Each pair token is bound to a specific chat session, preventing cross-session access
  6. Key file protection — Cryptographic keys stored with 0600 permissions, auto-rotated on password change
  7. Session eviction — LRU + TTL (256 max sessions, 1-hour expiry) prevents session accumulation

​
Security

  • Always enable password protection before exposing WebUI.
  • Prefer HTTPS endpoints; Myrm normalizes trailing slashes.
  • Use a stable domain for production webhooks (free random URLs change on restart).
  • Cloud-hosted deployments avoid home tunneling entirely.
  • Remote connections are protected by Trust Zone security (dangerous tools auto-disabled).
  • DNS rebinding protection: Host allowlist middleware rejects spoofed Host headers.
  • Pair token rotation: Password changes automatically invalidate all outstanding tokens.

​
Troubleshooting

​
Connectivity test fails

  1. Confirm the tunnel process is still running.
  2. Confirm the URL matches the WebUI port.
  3. On corporate networks, some tunnel domains are blocked — try another provider or LAN access.

​
Channel webhook still shows localhost

  1. Set Public Ingress first.
  2. Re-open the channel settings page to refresh the resolved webhook URL.