TCP and UDP services

Forward anything that isn’t TLS-with-SNI. The agent declares the listen port; the edge picks it up automatically.

TCP

TOWONEL_AGENT_TCP_SERVICES='[
  {"name":"forgejo-ssh", "origin":"forgejo:22",   "listen_port":2222},
  {"name":"prom-write",  "origin":"vm:8428",      "listen_port":9090}
]'

UDP

TOWONEL_AGENT_UDP_SERVICES='[
  {"name":"dns",       "origin":"127.0.0.1:5353", "listen_port":5353},
  {"name":"wireguard", "origin":"10.0.0.1:51820", "listen_port":51820}
]'

Datagrams are framed onto the agent↔edge QUIC tunnel (length-prefixed, up to 64 KiB). Sessions are reaped after 60s of inactivity on either side.

Reconciliation

Each agent boot reconciles the hub against the agent’s env: added entries are upserted, removed entries are deleted. The env is the source of truth — run at most one agent per tenant.

Port rules

• Each port is unique across all tenants. Claiming a port already bound to a different service is rejected at submission time.
• TCP and UDP live in independent port namespaces — 2222/tcp and 2222/udp can coexist.
• Privileged ports (< 1024) are blocked by default. Set TOWONEL_HUB_ALLOW_PRIVILEGED_PORTS=true on the hub to allow them.