Skip to content

Commit 22cc055

Browse files
dorlugasigaldorlugasigal
committed
Revert "feat(tunnel): make tunnel public by default for PWA compatibility"
This reverts commit 40aca9b.
1 parent 823d70f commit 22cc055

12 files changed

Lines changed: 187 additions & 177 deletions

File tree

‎README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -109,8 +109,7 @@ flowchart LR
109109
| `--port <port>` | Server port | `3456` |
110110
| `--host <addr>` | Bind address | `127.0.0.1` |
111111
| `--lan` | Bind to all interfaces (LAN access) | Off |
112-
| `--public` | Public tunnel access (default) | On |
113-
| `--private` | Require Microsoft login for tunnel access | Off |
112+
| `--public` | Allow public tunnel access (no Microsoft login) | Off |
114113
| `-i, --interactive` | Interactive setup wizard | Off |
115114
| `--log-level <level>` | Log verbosity (error/warn/info/debug) | `info` |
116115

‎docs/configuration.md‎

Lines changed: 22 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -7,24 +7,23 @@ description: All TermBeam CLI flags and options — ports, passwords, tunnels, s
77

88
## CLI Flags
99

10-
| Flag | Description | Default |
11-
| --------------------- | ----------------------------------------------------------------------------------------------------------------------- | -------------- |
12-
| `--password <pw>` | Set access password (also accepts `--password=<pw>`) | Auto-generated |
13-
| `--generate-password` | Auto-generate a secure password (default behavior) | On |
14-
| `--no-password` | Disable password authentication (cannot combine with tunnel) | — |
15-
| `--tunnel` | Create an ephemeral devtunnel URL (public access) | On |
16-
| `--no-tunnel` | Disable tunnel | — |
17-
| `--persisted-tunnel` | Create a reusable devtunnel URL (stable across restarts) | Off |
18-
| `--public` | Public tunnel access (default, kept for backwards compatibility) | On |
19-
| `--private` | Require Microsoft account login for tunnel access (adds AAD auth on top of TermBeam password). Breaks PWA icon display. | Off |
20-
| `--port <port>` | Server port (must be 1-65535) | `3456` |
21-
| `--host <addr>` | Bind address | `127.0.0.1` |
22-
| `--lan` | Bind to all interfaces (LAN access) | Off |
23-
| `-i, --interactive` | Interactive setup wizard — walks through password, port, access mode (tunnel type, visibility), and log level | Off |
24-
| `--force` | Stop any existing TermBeam server before starting a new one | Off |
25-
| `-h, --help` | Show help | — |
26-
| `-v, --version` | Show version | — |
27-
| `--log-level <level>` | Set log verbosity: `error`, `warn`, `info`, `debug` | `info` |
10+
| Flag | Description | Default |
11+
| --------------------- | ------------------------------------------------------------------------------------------------------------- | -------------- |
12+
| `--password <pw>` | Set access password (also accepts `--password=<pw>`) | Auto-generated |
13+
| `--generate-password` | Auto-generate a secure password (default behavior) | On |
14+
| `--no-password` | Disable password authentication (cannot combine with `--public`) | — |
15+
| `--tunnel` | Create an ephemeral devtunnel URL (private access) | On |
16+
| `--no-tunnel` | Disable tunnel | — |
17+
| `--persisted-tunnel` | Create a reusable devtunnel URL (stable across restarts) | Off |
18+
| `--public` | Allow public tunnel access (no Microsoft login required) | Off |
19+
| `--port <port>` | Server port (must be 1-65535) | `3456` |
20+
| `--host <addr>` | Bind address | `127.0.0.1` |
21+
| `--lan` | Bind to all interfaces (LAN access) | Off |
22+
| `-i, --interactive` | Interactive setup wizard — walks through password, port, access mode (tunnel type, visibility), and log level | Off |
23+
| `--force` | Stop any existing TermBeam server before starting a new one | Off |
24+
| `-h, --help` | Show help | — |
25+
| `-v, --version` | Show version | — |
26+
| `--log-level <level>` | Set log verbosity: `error`, `warn`, `info`, `debug` | `info` |
2827

2928
## Environment Variables
3029

@@ -137,22 +136,22 @@ termbeam --lan
137136
# Allow LAN access (equivalent to --lan)
138137
termbeam --host 0.0.0.0
139138

140-
# Tunnel is on by default (public access, password-protected)
139+
# Tunnel is on by default (private, owner-only access)
141140
termbeam
142141
```
143142

144143
### DevTunnel
145144

146-
The `--tunnel` flag creates a public URL using [Azure DevTunnels](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/). Anyone with the URL can reach the login page — TermBeam's password auth is the security layer:
145+
The `--tunnel` flag creates a private URL using [Azure DevTunnels](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/). By default, only the tunnel owner (you) can access it — visitors must authenticate with the same Microsoft account used by `devtunnel user login`:
147146

148147
```bash
149148
termbeam --password mysecret
150149
```
151150

152-
To add **Microsoft account login** on top of the password (private tunnel), use `--private`. Note: this breaks PWA icon display since browsers fetch icons without auth cookies:
151+
To allow **public access** (anyone with the URL can connect), add `--public`:
153152

154153
```bash
155-
termbeam --private --password mysecret
154+
termbeam --public --password mysecret
156155
```
157156

158157
For a **stable URL** that persists across restarts, use `--persisted-tunnel`:
@@ -168,7 +167,7 @@ termbeam --persisted-tunnel --password mysecret
168167

169168
<!-- prettier-ignore -->
170169
!!! warning
171-
A password is always auto-generated by default. Tunnel access is public by default — TermBeam password auth protects the terminal. Use `--private` to add Microsoft account login on top (note: this breaks PWA icon display). **Tunnel cannot be combined with `--no-password`** — TermBeam will refuse to start to prevent unauthenticated public exposure.
170+
A password is always auto-generated by default. By default, tunnel access is private (owner-only via Microsoft login). Use `--public` to allow public access. **`--public` cannot be combined with `--no-password`** — TermBeam will refuse to start to prevent unauthenticated public exposure.
172171

173172
Requirements:
174173

‎docs/security.md‎

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -19,30 +19,29 @@ TermBeam has three access layers that combine to determine your risk profile:
1919

2020
| Mode | Command | Who Can Connect | Auth | Risk |
2121
| ----------------------------- | ------------------------------------------ | ------------------------------------- | --------------------------------- | --------- |
22-
| **Default (public tunnel)** | `termbeam` | Anyone with the URL + password | Auto-password | ✅ Low |
23-
| **Private tunnel** | `termbeam --private` | Only you (Microsoft login + password) | Auto-password + tunnel owner auth | ✅ Low |
22+
| **Default (private tunnel)** | `termbeam` | Only you (Microsoft login + password) | Auto-password + tunnel owner auth | ✅ Low |
23+
| **Public tunnel** | `termbeam --public` | Anyone with the URL + password | Auto-password | ⚠️ Medium |
2424
| **LAN-only (localhost)** | `termbeam --no-tunnel` | Local machine only | Auto-password | ✅ Low |
2525
| **LAN-only (all interfaces)** | `termbeam --no-tunnel --lan` | Any device on your network | Auto-password | ⚠️ Medium |
2626
| **Localhost, no password** | `termbeam --no-tunnel --no-password` | Local processes only | None | ⚠️ Medium |
2727
| **LAN, no password** | `termbeam --no-tunnel --no-password --lan` | Anyone on your network | None | 🔴 High |
2828

2929
<!-- prettier-ignore -->
30-
!!! warning "Tunnel + `--no-password` is blocked"
31-
The CLI refuses to start with a tunnel and no password.
30+
!!! warning "`--public --no-password` is blocked"
31+
The CLI refuses to start with a public tunnel and no password.
3232

33-
### Public Tunnel (Default)
33+
### Private Tunnel (Default)
3434

35-
The default mode creates an ephemeral [Azure DevTunnel](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/) with public access. Anyone with the URL can reach the login page — TermBeam's password auth is the security layer:
35+
The default mode creates an ephemeral [Azure DevTunnel](https://learn.microsoft.com/en-us/azure/developer/dev-tunnels/) that requires **two layers of authentication**:
3636

37-
1. **TermBeam password** — auto-generated on each run
38-
2. **HTTPS** — the tunnel URL is encrypted end-to-end
39-
3. **Unguessable URL** — the tunnel ID is random
37+
1. **Microsoft account login** — only the tunnel owner can access the URL
38+
2. **TermBeam password** — auto-generated on each run
4039

41-
The DevTunnel AAD auth layer was removed as the default because it was redundant with TermBeam's own password auth and broke PWA icon display (browsers fetch icons without auth cookies).
40+
This is the safest way to access your terminal remotely. The tunnel URL is HTTPS, the connection is encrypted end-to-end, and the URL is unguessable.
4241

43-
### Private Tunnel
42+
### Public Tunnel
4443

45-
With `--private`, the tunnel adds Microsoft account login on top of the TermBeam password — only the tunnel owner can access the URL. This provides two layers of authentication but breaks PWA features (icons, manifest) since browsers fetch those resources without auth cookies.
44+
With `--public`, the tunnel URL is accessible to anyone who has it — no Microsoft login required. Password authentication is still enforced. This mode is useful for sharing temporary access, but the terminal is internet-accessible and protected only by the password and rate limiting (5 attempts/min/IP).
4645

4746
### LAN Exposure
4847

@@ -54,7 +53,7 @@ Out of the box, TermBeam is configured conservatively:
5453

5554
- ✅ **Password auto-generated** — a strong random password is created on every run
5655
- ✅ **Localhost bind** — server listens on `127.0.0.1` only
57-
- ✅ **Public tunnel with password** — tunnel is public but password-protected; use `--private` to add Microsoft login
56+
- ✅ **Private tunnel** — tunnel requires Microsoft account login (owner-only)
5857
- ✅ **Ephemeral tunnel** — tunnel URL is deleted when TermBeam exits
5958
- ✅ **Security headers** — X-Frame-Options, CSP, no-store, nosniff on all responses
6059
- ✅ **Rate-limited login** — 5 attempts per minute per IP
@@ -66,19 +65,19 @@ Out of the box, TermBeam is configured conservatively:
6665

6766
The following flags increase your attack surface. Use them only when you understand the trade-offs.
6867

69-
| Flag | Effect | When Acceptable |
70-
| -------------------------- | ------------------------------------------------- | ------------------------------------------------ |
71-
| `--private` | Adds Microsoft login to tunnel (breaks PWA icons) | Extra auth layer when PWA features aren't needed |
72-
| `--no-password` | Removes password auth | Localhost-only on a single-user machine |
73-
| `--lan` / `--host 0.0.0.0` | Binds to all interfaces | Trusted home network with password enabled |
74-
| `--lan --no-password` | LAN-accessible, no auth | **Not recommended** |
68+
| Flag | Effect | When Acceptable |
69+
| -------------------------- | ----------------------------------- | ----------------------------------------------------------------- |
70+
| `--public` | Removes Microsoft login from tunnel | Sharing temporary access with someone without a Microsoft account |
71+
| `--no-password` | Removes password auth | Localhost-only on a single-user machine |
72+
| `--lan` / `--host 0.0.0.0` | Binds to all interfaces | Trusted home network with password enabled |
73+
| `--lan --no-password` | LAN-accessible, no auth | **Not recommended** |
7574

7675
### Quick Safety Checklist
7776

7877
Before running TermBeam, verify:
7978

8079
- [ ] **Password is enabled** — don't use `--no-password` unless localhost-only on a trusted machine
81-
- [ ] **Tunnel is password-protected** — the auto-generated password is your primary defense for tunnel access
80+
- [ ] **Tunnel is private** — don't use `--public` unless you specifically need anonymous tunnel access
8281
- [ ] **Bind is localhost** — don't use `--lan` unless you need LAN access on a trusted network
8382
- [ ] **Close when done** — TermBeam is not a daemon; don't leave it running unattended
8483
- [ ] **Check the network** — on shared/public Wi-Fi, stick to defaults
@@ -185,7 +184,7 @@ The following UI features are entirely client-side and introduce **no new server
185184

186185
1. **Password is on by default** — use `--no-password` only for trusted localhost scenarios. `--public` requires password authentication and will refuse to start without it
187186
2. **Localhost is the default** — use `--lan` only when you need LAN access
188-
3. **Tunnel access is public by default** — protected by TermBeam's auto-generated password. Use `--private` to add Microsoft account login (note: breaks PWA icons), or `--no-tunnel` for LAN-only mode
187+
3. **Tunnel access is private by default** — only you (the tunnel owner) can access it via Microsoft login. Use `--public` to allow public access, or `--no-tunnel` for LAN-only mode
189188
4. **Close TermBeam when done** — it's not a daemon, don't leave it running
190189
5. **Use on trusted networks** — TermBeam is not designed for hostile environments
191190

0 commit comments

Comments
 (0)