> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmagent.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Public Access & Tunnel Options

> Choose your own NAT traversal tool and paste the URL into Myrm.

# Public Access & Tunnel Options

Myrm does **not** bundle a tunnel provider. You pick a tool that works in your region and network, obtain an HTTPS public URL, then paste it into **Settings → System → Public Ingress**.

## When you need a public URL

| Scenario                                                          | Need public Ingress?                       |
| ----------------------------------------------------------------- | ------------------------------------------ |
| Same Wi‑Fi / office LAN (phone or colleague)                      | No — use **LAN access** in System settings |
| Outbound channels (Feishu WebSocket, DingTalk, Telegram WS, etc.) | No — server connects outbound              |
| Inbound channels (LINE, Teams, webhooks, QQ Bot, etc.)            | **Yes**                                    |
| Cron webhook triggers                                             | **Yes**                                    |
| Remote WebUI from cellular / another network                      | **Yes** (paste tunnel URL)                 |
| Cloud-hosted Myrm (SaaS)                                          | No — platform injects the URL              |

Myrm shows **outbound / inbound badges** on channel cards and `ingress-requirement` in System settings so you know when a public URL is required.

## Recommended tools (pick one)

### China / corporate LAN

| Tool                                  | Notes                                                   |
| ------------------------------------- | ------------------------------------------------------- |
| [cpolar](https://www.cpolar.com/docs) | Free tier, China nodes, `cpolar http 3000`              |
| [NATAPP](https://natapp.cn/)          | Ngrok-style, domestic nodes (real-name may be required) |
| [花生壳](https://hsk.oray.com/)          | Common for home users                                   |
| **frp** (self-hosted)                 | Best control; needs a VPS with public IP                |

### International

| Tool                        | Notes                                                 |
| --------------------------- | ----------------------------------------------------- |
| **frp** / **nps**           | Self-hosted on your VPS                               |
| **ngrok**                   | Quick trials; URL may change on free tier             |
| **Cloudflare Named Tunnel** | Stable domain; edge connectivity varies by region     |
| **Reverse proxy**           | nginx/Caddy on a cloud VM pointing to your WebUI port |

## Setup workflow

1. Enable **WebUI password protection** (System settings).
2. Run your tunnel tool against the WebUI port (default `3000`).
3. Copy the **HTTPS** public URL (no trailing slash).
4. Paste into **Settings → System → Public Ingress**.
5. Click **Test connectivity**.
6. Configure inbound channels or cron webhooks; refresh channel pages so webhook URLs update.

### Example: cpolar (China)

```bash theme={null}
# Install (see cpolar docs)
curl -L https://www.cpolar.com/static/downloads/install-release-cpolar.sh | sudo bash
cpolar authtoken <your-token>
cpolar http 3000
```

Copy the `https://….cpolar….` URL into Myrm Public Ingress.

## Built-in Quick Tunnel (One-click)

Myrm also includes a built-in **Cloudflare Quick Tunnel** for instant remote access without installing external tools:

1. Open **Settings → System → Remote Access**.
2. Click **Start Tunnel** — a temporary HTTPS URL is generated in \~5–15 seconds.
3. Scan the **QR code** with your phone to open the Mobile Hub.

**Important**: Quick Tunnel generates a random URL each time. Use it for quick mobile access, not for permanent webhooks. For stable webhook URLs, use the self-hosted tools above.

### Mobile Hub

Once the tunnel is running, the **Mobile Session Hub** lets you:

* View all active Agent sessions from your phone
* Open and control a specific session with push-to-talk voice input
* Receive real-time SSE progress updates
* Approve HITL requests, steer, or **stop tasks remotely** (with success/failure toast — works even when re-attaching to an in-progress SSE stream)

Access is protected by **7 layers of security**:

1. **E2EE** — End-to-end encryption (NaCl Box: Curve25519 + XSalsa20-Poly1305) for all mobile traffic
2. **HMAC pair tokens** — SHA-256 signed tokens with automatic TTL renewal and purpose-scoped authorization
3. **Trust Zone** — 6 admission paths auto-classified into 3 trust levels; remote requests are `REMOTE_EXPOSED`
4. **Tool restrictions** — Dangerous tools (shell, file\_write, yolo\_mode) automatically disabled for remote sessions
5. **Chat-scoped binding** — Each pair token is bound to a specific chat session, preventing cross-session access
6. **Key file protection** — Cryptographic keys stored with 0600 permissions, auto-rotated on password change
7. **Session eviction** — LRU + TTL (256 max sessions, 1-hour expiry) prevents session accumulation

## Security

* Always enable password protection before exposing WebUI.
* Prefer HTTPS endpoints; Myrm normalizes trailing slashes.
* Use a **stable domain** for production webhooks (free random URLs change on restart).
* Cloud-hosted deployments avoid home tunneling entirely.
* Remote connections are protected by **Trust Zone** security (dangerous tools auto-disabled).
* **DNS rebinding protection**: Host allowlist middleware rejects spoofed Host headers.
* **Pair token rotation**: Password changes automatically invalidate all outstanding tokens.

## Troubleshooting

### Connectivity test fails

1. Confirm the tunnel process is still running.
2. Confirm the URL matches the WebUI port.
3. On corporate networks, some tunnel domains are blocked — try another provider or LAN access.

### Channel webhook still shows `localhost`

1. Set **Public Ingress** first.
2. Re-open the channel settings page to refresh the resolved webhook URL.