One GUI for tunnels, proxies and Kubernetes app ingress — wire web apps, services and game servers to the public internet without opening a single port at home.
curl -fsSL https://proxyctl.cc/install.sh | bash
Cloudflare Tunnel for web apps. WireGuard + iptables for game ports. One UI for both.
Stop hand-editing wg0.conf, iptables and cloudflared YAML. Click an app, click a target, click apply.
Hostname → app, one click. Cloudflare terminates TLS; cloudflared dials out from home. No public ports. No certs to renew.
Players hit a public droplet; ProxyCTL renders the droplet wg0.conf and the in-cluster wg-gateway rules so packets land on the right Service.
Browse namespaces and Services in your cluster, see ports + pod readiness, pick a target — no ClusterIP copy-paste.
Your home network never exposes anything. The droplet and Cloudflare are the front door; everything dials out.
API + embedded UI in a single container. Stdlib HTTP, no plugin runtime, no agent to install on the target.
Apply uses your ambient ssh-agent and kubectl context. Private keys are never read, rendered, or held in memory.
Two real paths, one control plane: web traffic via Cloudflare, game traffic via WireGuard. ProxyCTL is the GUI that drives both.
Anything you want online but don't want to expose at home.
On the roadmap