TRAFORO

HTTP tunnel via Cloudflare Durable Objects and WebSockets. Expose local servers to the internet with a simple CLI. Infinitely scalable with support for Cloudflare CDN caching and password protection.

INSTALLATION

npm install -g traforo

USAGE

Expose a local server:

traforo -p 3000

With a custom tunnel ID (only for services safe to expose publicly):

traforo -p 3000 -t my-app

Run a command and tunnel it:

traforo -p 3000 -- next start
traforo -p 3000 -- pnpm dev
traforo -p 5173 -- vite

The tunnel URL will be:

https://{tunnel-id}-tunnel.traforo.dev

OPTIONS

-p, --port <port>          Local port to expose (required)
-t, --tunnel-id [id]       Custom tunnel ID (prefer random default)
-c, --cache [key]          Enable edge caching (optional partition key)
--password <password>      Protect the tunnel with a password
-h, --host [host]          Local host (default: localhost)
-s, --server [url]         Custom tunnel server URL
--help                     Show help
--version                  Show version

EDGE CACHING

Cache responses at Cloudflare's edge so repeat requests never hit your local machine:

traforo -p 3000 --cache

What gets cached:

• GET requests where the origin sends cacheable Cache-Control headers (public, max-age, s-maxage)
• Static asset extensions use Cloudflare-like default fallback TTLs when cache headers are missing: 200/301=120m, 302/303=20m, 404/410=3m

What never gets cached:

• Non-GET requests
• 206 Partial Content responses (Cache API put() limitation)
• Responses with Set-Cookie, Cache-Control: no-store/no-cache/private
• Streaming responses (SSE, ndjson)
• WebSocket connections

Requests with Authorization, Cache-Control: no-cache/no-store/max-age=0, or Pragma: no-cache bypass edge cache lookup.

Cache partitioning lets you bust all cached content by changing the key:

traforo -p 3000 --cache v1     # first deployment
traforo -p 3000 --cache v2     # new deploy, fresh cache

Each key creates a separate cache namespace. Old entries expire via TTL.

The X-Traforo-Cache response header shows HIT, MISS, or BYPASS for debugging. When BYPASS/MISS comes from the local origin path, X-Traforo-Cache-Reason explains why.

PASSWORD PROTECTION

Restrict tunnel access with a password:

traforo -p 3000 --password mysecret

Visitors in a browser see a login page. After entering the correct password a traforo-password cookie is set and they can browse normally.

Non-browser clients (curl, APIs) get a 401 Unauthorized response with instructions to pass the password as a cookie:

curl -b 'traforo-password=mysecret' https://{tunnel-id}-tunnel.traforo.dev

WebSocket upgrade requests without the correct cookie are rejected with close code 4013.

HOW IT WORKS

1. Local client connects to Cloudflare Durable Object via WebSocket
2. HTTP requests to tunnel URL are forwarded to the DO
3. DO sends requests over WebSocket to local client
4. Local client makes request to localhost and returns response
5. WebSocket connections from users are also proxied through

API ENDPOINTS

/traforo-status         Check if tunnel is online
/traforo-upstream       WebSocket endpoint for local client
/traforo-login          POST endpoint for password login
/*                      All other paths proxied to local server

LIBRARY USAGE

import { TunnelClient } from 'traforo/client'
import { runTunnel } from 'traforo/run-tunnel'

const client = new TunnelClient({
  localPort: 3000,
  tunnelId: 'my-app',
  cacheKey: 'v1',       // optional: enable edge caching
  password: 'mysecret', // optional: password protection
})

await client.connect()

LICENSE

MIT