Argus

Appearance

Gateway Tunnel ​

Let Argus manage a tunnel that routes a public URL back to the gateway — the easiest way to reach it from your phone (a reverse proxy works too, and both the CLI and the app can reach it over SSH).

Cloudflare ​

Provider: Cloudflare Tunnel (requires cloudflared on PATH). Pick a mode with --tunnel; plain --tunnel cloudflare infers it from the --cloudflare-* flags. The tunnel edge terminates TLS; if it dies, Argus retries with backoff and keeps serving on your LAN.

Whichever provider you pick, a tunnel that comes up but reports no public URL within a minute is fatal: Argus exits instead of handing out pairing QRs that encode the LAN address.

Quick ​

An ephemeral URL that changes on each run — fine for a quick pairing test.

sh
argus start --tunnel cloudflare:quick --token <TOKEN>

Remote ​

A stable hostname for a tunnel you configured in the Cloudflare dashboard, run via its token:

sh
argus start --tunnel cloudflare:remote --cloudflare-token <CLOUDFLARE_TOKEN> --token <TOKEN>
  • Argus reads the public hostname from the tunnel's remotely-managed ingress, which cloudflared reports once it connects — nothing to pass on the command line. If the tunnel routes several public hostnames, the first one wins; wildcard (*.example.com) and path-scoped rules are skipped, since neither yields a URL pairing can reach.
  • Configure the tunnel's public hostname to point at the gateway's listen address (http://localhost:8443 by default) in the Cloudflare dashboard.
  • Reading that ingress requires cloudflared --loglevel info, so this mode runs it one level chattier than the others. The extra lines are classified as debug and stay below the fold unless you pass --log-level debug.

Local ​

A stable hostname where Argus creates and owns the tunnel + DNS:

sh
argus start --tunnel cloudflare:local --cloudflare-hostname argus.example.com --token <TOKEN>
  • It needs a Cloudflare origin certificate. If it's missing and you're at a terminal, Argus runs cloudflared tunnel login for you; otherwise run it yourself (it writes ~/.cloudflared/cert.pem).
  • The tunnel is named argus, you can override with --cloudflare-tunnel-name flag.
  • The hostname must be in a zone in the same Cloudflare account as the cert.

ngrok ​

Provider: ngrok (requires ngrok on PATH and an ngrok account). Argus runs a public HTTP tunnel to the gateway. By default it uses your account's free static dev domain — a stable URL, so pairing survives restarts:

sh
argus start --token <TOKEN> --tunnel ngrok

  • --ngrok-domain <domain> binds a reserved/custom domain instead. Reserve it in the ngrok dashboard first (the agent doesn't provision it):

    sh
    argus start --token <TOKEN> --tunnel ngrok --ngrok-domain argus.example.com

  • ngrok needs an authtoken. Set NGROK_AUTHTOKEN, or — if it's missing and you're at a terminal — Argus prompts for one and stores it via ngrok config add-authtoken; otherwise run that yourself first.

Zrok ​

Provider: zrok v2 (requires zrok2 on PATH and a zrok account — the hosted service or a self-hosted instance). Argus runs a public share at a stable URL backed by a reserved name:

sh
argus start --token <TOKEN> --tunnel zrok --zrok-name argus
  • --zrok-name is the reserved name (name, or namespace:name; the namespace defaults to public, i.e. https://myapp.shares.zrok.io). Defaults to argus (→ https://argus.shares.zrok.io) when unset. Argus creates the name if it doesn't exist.
  • The environment must be enabled (zrok2 enable). If it isn't and you're at a terminal, Argus prompts for your zrok account token and enables it for you; otherwise run zrok2 enable <token> yourself first.
  • For a self-hosted instance, point the CLI at it with ZROK2_API_ENDPOINT (or zrok2 config set apiEndpoint …); Argus's child zrok2 inherits the environment.

External ​

Provider: external — a tunnel you manage yourself (a reverse proxy, ingress, or ssh -R) that already terminates TLS and forwards to the local gateway. Argus runs no process; it only records the public URL so pairing QRs point at the right host:

sh
argus start --token <TOKEN> --tunnel external --external-url wss://argus.example.com
  • --external-url is required — the gateway's public URL, scheme://host[/base-path] with scheme ws, wss, http, or https (also $ARGUS_EXTERNAL_URL). No query, fragment, or user info; it's echoed into pairing QRs.

TIP

A tunnel can't accidentally publish an open gateway — every gateway requires a --token regardless of how it's exposed. See Multi Machine for the other ways to reach a gateway (SSH or a reverse proxy).