> ## Documentation Index
> Fetch the complete documentation index at: https://usenaive.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Public link (access from anywhere)

> Reach your Tower's dashboard from anywhere over a Naive-owned edge relay — no inbound ports, no port-forwarding, no dynamic DNS.

A Tower is normally reached over the LAN (`http://tower.local`). The **public
link** makes it reachable from anywhere at `https://{slug}.tower.usenaive.ai`
**without opening a single inbound port** on the box.

## How it works

The box holds ONE authenticated **outbound** WebSocket tunnel to the Naive
**edge relay**. The edge terminates TLS on the wildcard `*.tower.usenaive.ai`,
maps your `{slug}` to that tunnel, and reverse-proxies inbound HTTPS down it to
the box's panel/api.

```
you, anywhere ──https {slug}.tower.usenaive.ai──▶ edge relay ──over 1 outbound WS──▶ box panel
box (device-agent tunnel) ──dial + register slug, device-token auth──▶ edge relay
```

Because the box always *dials out*, there is nothing to port-forward and no
inbound firewall exception. The edge only proxies HTTP down the tunnel — it has
no privileged access to the box, and each device authenticates with its device
token + an enabled slug, so one box's traffic never crosses into another's.

<Note>
  This is a **separate service** from the [egress gateway](/docs/self-hosting/security-model).
  The egress gateway is strictly *outbound* (runtime-initiated, credential
  injecting). The edge relay is *inbound* reverse-proxy. The box's outbound-only
  posture is preserved — the tunnel is an opt-in **outbound-initiated** connection.
</Note>

## Enable it

The public link is opt-in. The device-agent's `tunnel` command holds the
outbound socket; enable/disable + status are device-token routes:

```bash theme={"theme":"css-variables"}
# on the box (device-token authenticated)
curl -X POST http://tower.local/v1/devices/self/tunnel/enable   # → { url: "https://t-….tower.usenaive.ai" }
curl http://tower.local/v1/devices/self/tunnel                  # status
curl -X POST http://tower.local/v1/devices/self/tunnel/disable  # stop routing
```

The link also appears in the panel onboarding (Step 3) next to the LAN URL.

## Deploying the edge

The edge (`@usenaive/edge`) is a cloud-profile service. A real deployment needs
a wildcard DNS record + TLS cert for `*.tower.usenaive.ai` pointed at it; TLS
can be terminated at the platform ingress or by the edge itself
(`EDGE_TLS_KEY`/`EDGE_TLS_CERT`). See the package README for configuration.