Skip to main content
A Tower is normally reached over the LAN (http://tower.local). The public link makes it reachable from anywhere at https://{slug}.tower.usenaive.ai without opening a single inbound port on the box.

​
How it works

The box holds ONE authenticated outbound WebSocket tunnel to the Naive edge relay. The edge terminates TLS on the wildcard *.tower.usenaive.ai, maps your {slug} to that tunnel, and reverse-proxies inbound HTTPS down it to the box’s panel/api.
Because the box always dials out, there is nothing to port-forward and no inbound firewall exception. The edge only proxies HTTP down the tunnel — it has no privileged access to the box, and each device authenticates with its device token + an enabled slug, so one box’s traffic never crosses into another’s.
This is a separate service from the egress gateway. The egress gateway is strictly outbound (runtime-initiated, credential injecting). The edge relay is inbound reverse-proxy. The box’s outbound-only posture is preserved — the tunnel is an opt-in outbound-initiated connection.

​
Enable it

The public link is opt-in. The device-agent’s tunnel command holds the outbound socket; enable/disable + status are device-token routes:
The link also appears in the panel onboarding (Step 3) next to the LAN URL.

​
Deploying the edge

The edge (@usenaive/edge) is a cloud-profile service. A real deployment needs a wildcard DNS record + TLS cert for *.tower.usenaive.ai pointed at it; TLS can be terminated at the platform ingress or by the edge itself (EDGE_TLS_KEY/EDGE_TLS_CERT). See the package README for configuration.