Serving your ongoing apps through a secure gateway
Cloud Link began as a way to reach OpenCode from your phone. The same tunnel can do a little more than that: point it at the apps you keep running on your machine — a dev server, an API, a dashboard — and they become reachable through the same authenticated address. No second tunnel, no new account, no port forwarding.
One tunnel, more than OpenCode
The gateway already authenticates every request at your machine before it reaches anything. A service inherits the same posture: traffic arrives at your loopback app only when it carries your Cloud Link credentials — unless you explicitly decide otherwise. It is the same connection your phone and the OpenCode web UI use, carrying a little more.
How it works
- Pick a path on your machine's address, for example
/preview. - Point it at a loopback target —
127.0.0.1:3000— where the app is already listening. - Enable it. Changes apply live: no tunnel restart, no reconnect.
Services are managed from the tray, or from the command line withopencode-cloudlink services. They are local configuration on your machine: the connector makes no control-plane request for services, and no new Cloudflare resource is created.
Safe by default
- Disabled until you enable them. New services do nothing until you turn them on.
- Private unless you say otherwise. Access requires your Cloud Link credential; marking a service public is an explicit, per-service choice.
- Loopback only. Targets must be local (
127.0.0.1or::1) on an unprivileged port. Basic ports such as 80 and 443 are reserved, and the managed OpenCode port range can never be targeted. - A separate origin. Services are served on their own origin, so OpenCode's web UI and credentials never mix with a service, and OpenCode paths are never shadowed.
- Correct path handling. Cloud Link strips the matched prefix, forwards
X-Forwarded-Prefix, and re-prefixes path-absolute redirects, so apps behind a subpath keep working.
Good fits
- Preview builds and staging servers you want to check from a phone.
- Internal dashboards and tools that already listen on loopback.
- Small APIs your mobile workflows call directly.
- Documentation served locally, reachable while you are out.
The honest limits
Two things to know. Public and private services share one services origin, so a public page can attempt same-origin requests to private paths using your browser's cached credentials — mark a service public only when its content is trusted. And apps that generate absolute URLs or load root-relative assets may need their own base-path setting to work under a subpath.
OpenCode stays the heart of Cloud Link. But your machine is more than one server, and the gateway does not mind carrying a little extra.
Related: Why Cloud Link covers the full list of capabilities, from approval-gated pairing to Keep awake.