Put your homelab on the public Internet.

Cruma gives anything running on your machine a public HTTPS URL, from a one-line CLI tunnel to a desktop app with request inspection. The agent is also a full local web server and reverse proxy, free for personal use.

Download the agent

See plans →

Free · no account needed · works behind CGNAT and firewalls · other platforms

One command

~/dev · zsh

$ cruma proxy http localhost:3000

→ https://random-id.tun.cruma.io

~/dev · zsh

$ cruma serve ~/example-www

→ https://random-id.tun.cruma.io

End-to-end TLS on your own domain
Request logs stay on your machine
No monthly traffic cap

Cruma desktop app Tour →

The Dashboard with guided-setup cards, three active routes named api, app and docs, and an unexposed process called file-server

The Requests page with a list of HTTP requests and one expanded to show Request, Response and Timing tabs and buttons for Request, cURL and Ask AI

The Setup Wizard, where you enter your service address and a hostname

The Statistics page with tiles for total requests, errors, average latency and error rate, status code counts, and a traffic chart

The Service Map showing which clients called which hosts, with request counts

The Processes page with one running process called file-server and Stop All, Start All and Add Process buttons

Running in a minute.

No account, no config file, no router settings. Install the agent, point it at your app, and share the link.

1

Install the agent

Get the app for Windows, macOS or Linux from Downloads, or install the command-line agent on Linux:

curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash

2

Point it at your app

Anything running locally works: a dev server, an API, a homelab dashboard.

cruma proxy http localhost:3000

In the app, pick Share a Web Service instead.

3

Share the link

You get a public HTTPS address like random-id.tun.cruma.io, ready to send to anyone. No sign-up needed: anonymous tunnels run for up to 3 hours at a time.

4

Keep it running

Create a free account and a tunnel to lift the time limit, then select Authenticate in the app and paste the tunnel's ID and secret. On Basic, add your own domain with end-to-end encryption.

More than a tunnel.

The same agent that opens your tunnel runs your apps, guards them and shows you every request. All of it runs on your machine.

Hosted processes

Let the agent start your Node, Python or any other app, restart it if it crashes, and even start it only when the first request arrives.

Run a process →

Firewall and WAF

Allow or drop traffic by IP, hostname or port before any TLS work is done, block bad paths and user agents, and auto-ban abusive clients.

Firewall rules →

Built-in sign-in

Put a login in front of any site: any OAuth2/OIDC provider, a simple form, JWT validation or API keys. No code changes in your app.

Access controls →

Request inspection

Every request and response, with statistics, logs and a service map, in the desktop app and the TUI. The logs never leave your machine.

Watch your traffic →

Route simulator

Ask which route, backend and firewall rule a request would hit before you send it, then confirm with a live probe.

Test your routing →

AI assistant and MCP

Ask "why isn't my site loading?" in plain English, or connect Claude Code and other tools to the agent's MCP server.

Meet the assistant →

Kubernetes targets

Point a route straight at a service in your cluster by kubeconfig context, namespace and port. No ingress controller needed.

Route to a cluster →

Your own public IPv6

On Pro, give your machine a public IPv6 address for any TCP or UDP service, even behind CGNAT or an IPv4-only connection. TCP port forwarding comes with Basic.

TCP ports and IPv6 →

Start free. Upgrade when it earns its keep.

Free tunnels for quick testing, paid tunnels for custom domains, stronger privacy, and consistent performance. Free is for individual, non-commercial development use — not company-wide rollout. No tier has a monthly traffic cap: sustained heavy use slows down instead of being cut off.

Anonymous $0no signup

Disposable quick tunnels

Best for trying Cruma fast or sharing a localhost app for a short test.

3-hour session window
Quick localhost sharing
No account required

Download agent →

Free $0registered

Persistent dev usage

Repeat use, moderate bandwidth, personal projects without the time cap. Fits 1–3 low-traffic sites.

No 3-hour session limit
Higher allowances than anonymous
Personal, non-commercial use

Create free account →

The first serious paid tier

For developers, internal tools, client work, and small teams who need custom domains and agent-side TLS.

Custom domains (CNAME)
End-to-end encryption
100 Mbps, no monthly traffic cap

Start with Basic →

Pro $10/ month

Higher priority under load

Recommended if you serve more than 3 sites on one tunnel. Same capabilities as Basic with priority traffic, plus up to 3 agents for multi-location load balancing.

Everything in Basic
Unlimited speed, no monthly traffic cap
Higher priority under load
Up to 3 agents, load balanced

Start with Pro →

How Cruma stacks up.

Cruma is a focused tunnel for developers, small teams, and homelabs. We optimize for fast setup, local-first tooling, and privacy options rather than enterprise policy suites. High-level comparison with Cloudflare Tunnel and ngrok based on publicly documented features, as of October 2026.

Legend ✓ Available ~ Limited / extra config $ Paid plans × Not available

Feature	Cruma	Cloudflare Tunnels	ngrok
Custom domains with E2E encryption	$ Yes (subscribed) — create a CNAME to your tunnel's domain; the agent terminates TLS locally and forwards to your app. Requires a paid subscription.	× No (for E2E) — custom domains supported, but HTTP(S) terminates at Cloudflare's edge, so plaintext is visible at that point.	$ Paid — custom domains on paid plans.
HTTP request inspection	✓ Local UI — inspect in the TUI and desktop app; request logs never leave your machine.	~ Zero Trust dashboards — routes through Cloudflare's edge, so logs live in their SaaS; no local inspector.	× Remote-only — primary inspector UI runs in their cloud dashboard.
Built-in access controls	✓ IP allow-lists, forms, API keys, JWT & OAuth2 — allow-list source IPs per tunnel, or put form auth, API keys, JWT validation, or sign-in through any OAuth2/OIDC provider in front of any HTTP backend.	~ Via Zero Trust policies — HTTP access control via Cloudflare Access, managed in their SaaS control plane.	$ Paid — access control and traffic-shaping on paid plans.
Serve local directories	✓ Built-in directory server — serve a local directory straight from the agent, no nginx needed.	× No built-in static server — run your own web server or use Cloudflare Pages.	× No built-in static server — run a local server yourself and point ngrok at it.
Local UX & tooling	✓ TUI + desktop app — desktop app for config and request inspection, plus a terminal TUI. Headless mode available.	~ CLI + hosted dashboard — configured via CLI and Zero Trust dashboards; no full local web UI.	~ CLI + remote inspector — request inspector and many options live in the cloud dashboard.
Monthly traffic caps	✓ None — no monthly data quota. A large full-speed allowance refills continuously; only sustained bulk traffic slows down, and nothing is cut off.	✓ None published — no data quota for tunnels, though Cloudflare's terms restrict serving large media files.	$ Metered — each plan includes a data-transfer allowance; extra usage is billed.
End-to-end encryption	✓ Supported (subscribed) — TLS terminates on the agent as soon as a cert is generated, so Cruma only sees encrypted payloads. TLS passthrough also supported.	× Not provider-blind — for standard HTTP(S) tunnels, TLS terminates at Cloudflare's edge, so plaintext is visible there.	✓ Supported — TLS passthrough and agent-side termination keep keys local.
Protocol forwarding	$ TCP & UDP — TCP port forwarding on Basic and Pro; on Pro, the IPv6 tunnel gives your machine its own public IPv6 address for any TCP or UDP traffic. Both work behind IPv4-only or CGNAT connections; connecting clients need IPv6.	✓ TCP & UDP — cloudflared supports UDP forwarding (Warp/QUIC proxies require Zero Trust setup).	~ TCP — ngrok's public service currently supports TCP forwarding.
Multi-endpoint	✓ Yes — serve any number of endpoints using different hostnames.	✓ Yes — serve any number of endpoints using different hostnames.	$ Paid — multiple endpoints on paid plans only.
Account-free quick tunnels	✓ Yes — anonymous mode for quick tunnels without an account. Aggressively rate-limited for fair usage.	✓ Yes — supported via "Quick Tunnels" at trycloudflare.com. Aggressively rate-limited; relaxed with a free account.	× No — requires an account and auth token.
Agent uplink protocols	✓ QUIC + HTTP/2 — agents keep TLS-encrypted QUIC and HTTP/2 sessions for lower latency and resilience.	✓ QUIC + HTTP/2 — cloudflared can use QUIC uplinks and HTTP/2 over TLS in supported configs.	~ HTTP/2 — speaks HTTP/2 to its control plane; no public QUIC uplink.

Pick your platform. Install the agent.

The latest tunnel agent is a single binary. Use our installer scripts or grab raw artifacts.

Windows agent

Download the agent

Get Cruma from the Microsoft Store — installs and keeps the app updated automatically.

Linux agent

Download the AppImage

Download Cruma AppImage — the desktop GUI build for GNU/Linux. Or install the terminal agent via the helper script:

curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash

Uninstall with the same script:

curl -fsSL https://files.cruma.io/files/tunnel-agent/install/linux-install.sh | bash -s -- --uninstall

Debian, RPM, Arch, and Flatpak packaging flows are expanding. Raw artifacts.

macOS agent

Download the app

Download cruma.dmg. Or install via Homebrew:

brew install --cask umbra-yurei/brew/cruma

Raw artifacts.

Questions, answered.

Do I need an account?

No. Download the agent and run it, and you get a public HTTPS address straight away. Anonymous tunnels last up to 3 hours per session, with up to 1 GB of traffic and 1 million requests; after that, visitors see a notice page until you reconnect. A free account removes the time limit.

Is the free plan enough?

For personal, non-commercial projects, usually yes: no session limit and enough speed for a few low-traffic sites. Paid plans add custom domains, end-to-end encryption, TCP ports and more speed. See Rate limits for the details.

Can Cruma see my traffic?

On Basic and Pro, no: the agent gets its own certificate and TLS ends on your machine, so Cruma only relays encrypted traffic. On anonymous and free tunnels, TLS ends at Cruma's edge. Request logs stay on your machine on every plan. See Security.

Does it work behind CGNAT or a strict firewall?

Yes. The agent makes an outgoing connection to Cruma, so there are no ports to open on your router and no public IP needed.

Which platforms are supported?

Windows (from the Microsoft Store), macOS (an app download or Homebrew) and Linux (an AppImage or an install script for the command-line agent). See Downloads.

Can I use my own domain?

Yes, on Basic and Pro. Point a CNAME at your tunnel and the agent gets a certificate automatically. See Custom domains, or host the domain on Cruma DNS.

Can I share SSH, game servers or other non-web services?

Yes. Basic and Pro forward TCP ports, and Pro adds an IPv6 tunnel for any TCP or UDP traffic. People connecting to those need IPv6. See TCP ports and the IPv6 tunnel.

One account, more tools.

Tunnels are one part of Cruma. The same account gets you the rest of the platform.

Generally available

Cruma DNS

Host your domains on Cruma's nameservers, with records that can answer each country differently. Point a record at your tunnel and your custom domain is live, with end-to-end TLS on Basic.

Cruma DNS docs →

Websites

Cruma Pages

Turn a Git repository of Markdown into a fast, searchable website, built and published on every push. This site runs on it.

Cruma Pages docs →

Widget

Promenade

One script tag turns any web page into a shared place: visitors walk the text as stick figures and can chat, talk and see each other.

Promenade docs →

Private preview

Catacombs

Run container images and Linux machines, each in its own hardware-isolated micro-VM, with private networking and a public hostname.

Catacombs docs →

Private preview

Cruma Flow

Build workflows visually or in YAML, bring people in to approve and vote, and run CI/CD pipelines on isolated runners.

Cruma Flow docs →

What we're building next.

What's under way now that Cruma is live and the core platform is in production.

building R1

Agent web UI

Open your agent's dashboard in a browser: traffic stats, logs and connections for agents on a server, NAS or Raspberry Pi with no desktop. Local-only and behind sign-in.

building R2

Domain registration

Search for, buy and renew domain names from the Cruma dashboard. A domain bought here is set up on Cruma DNS and ready to point at your tunnel straight away.

planned R3

UDP port forwarding

Forward a UDP port the way TCP ports work today, without installing the IPv6 tunnel: game servers, WireGuard, DNS and other UDP services on a public address.

planned R4

Container hosting

Let the agent run your Docker or Podman containers and route traffic to them, with optional tracing through OpenTelemetry backends such as Jaeger, Grafana or Aspire.

planned R5

Kubernetes ingress

Ship a Cruma Ingress/Gateway controller so cluster services get HTTPS endpoints exposed through cruma.io automatically.

Get started

Put your homelab online in a minute.

Free to start, no account needed. Upgrade when you want your own domain.

Download the agent

Create a free account

Library

Docs

Welcome to our library! You can click the three dots in the navbar, or press ctrl+k if you wish to search for anything specific.

Error 404

Page not found

Back home

Hello this is a test

Privacy policy

This policy explains what cruma.io and the Cruma app collect, why, and how to turn it off. Questions and requests go to [email protected].

What we collect, and why

We run our own product analytics so we can see how visitors move from the website to a download, to the first launch of the app, and to a first tunnel connection. On the website this works without cookies: our analytics store nothing in your browser.

On our websites and downloads

When you view a page on cruma.io, click one of its download links, download a file from files.cruma.io, or the app checks for updates or connects to our tunnel service, we log:

A visit ID. A random value your browser creates for each page view. It is never stored on your device, so it cannot recognise you on your next visit. Links from cruma.io to downloads and the dashboard carry it, so we can tie a download to the page view it came from.
A hashed IP address. We hash your IP address with a salt that changes every day. The salt is deleted after 48 hours, and after that the hash can no longer be linked back to an IP address. We never store the raw IP address.
Country, when our CDN provides it.
Browser and operating system family (for example "Firefox" or "macOS"), not the full user-agent string.
The referrer, meaning the site that sent you here, plus any campaign tags (utm_*, and oppref if you arrived from one of our ads) in the URL.
The page, file or endpoint involved, and the time. For a click on a download link, the platform you picked and whether it was an app store link.

In the Cruma app

When the app checks for updates, and when it connects to our tunnel service, it sends:

its version, operating system, CPU architecture, release channel, and whether it is the desktop or command-line build;
a random install ID. It is created the first time the app runs and saved in the app's cache folder. It is not derived from your hardware, your account or your tunnels. Deleting the cache folder creates a new one.
a flag on the very first launch.

To turn the install ID off, switch off telemetry in the app's settings (settings.yaml), or set the environment variable CRUMA_NO_TELEMETRY=1. With either one set, the app sends only its version and platform, with no install ID or first-launch flag. Update checks keep working.

Legal basis

We process this data on the basis of our legitimate interest (GDPR Article 6(1)(f)) in understanding how people find, install and start using Cruma, so we can improve it. The data is pseudonymous, used only for our own analytics, and never sold or used to build advertising profiles.

Retention

The daily IP salt is deleted after 48 hours, which makes older IP hashes unlinkable.
Raw analytics events are kept for at most 13 months, and are then deleted or reduced to aggregate counts.

Advertising (only with your consent)

We advertise Cruma, and we want to know which ads lead to a download. If you accept in the banner on cruma.io, we measure that with our ad partner. If you decline, none of this happens.

Our ad partners. Currently one: OpenAI (OpenAI Ads), which processes data in the United States. If we add a partner, this list changes and we ask you again.

What is shared, once you accept:

From your browser: the OpenAI Ads pixel is loaded on cruma.io and sends OpenAI the page you viewed, your IP address and browser details, together with the identifiers it stores. Until you accept, your browser makes no request to OpenAI.
From our servers: when you download or start Cruma, we may report that event (for example "app started") to OpenAI's Conversions API, together with the oppref ad-click ID from the link you arrived on, so OpenAI can tell which ad it came from. We send these server-side events only after advertising consent is confirmed. Without your consent we send nothing.

What cruma.io stores on your device.

Always, because the site needs it (no consent asked): your theme preference in local storage (pm-theme…). cruma.io sets no cookie of its own.
After you make a choice: the site stores that choice locally so it can apply it on future visits.
Only after you accept ad measurement: the OpenAI storage configured for this site is listed below. OpenAI's own servers may also set their own cookies on their own domains.
When you withdraw ("Privacy choices", then Decline): the ad partner's cookies and storage are removed from cruma.io and we stop sharing.

Withdrawing consent is as easy as giving it: use the Privacy choices link in the footer of every page, then choose Decline. We then stop sharing for future visits, delete the cookies and storage the pixel set on cruma.io, and reload the page without the pixel. Data already sent to OpenAI stays with OpenAI under its own policy, and you can ask them to delete it.

Your rights

You can ask for access to, correction of, or deletion of your personal data, and you can object to processing based on legitimate interest. Because we only keep pseudonymous data, we may need details from you, such as your install ID, to find your records. Write to [email protected]. You can also complain to the Swedish Authority for Privacy Protection (IMY).