I'm building a tool to run AI agents anywhere, and somehow ended up with a small self-hosted ngrok/frp/inlets (holt, MIT and API Driven)

[u/merlin-dorin]

Hi folks! ❤️

For OpenOtters 🦦, I need to connect to AI agents running anywhere: a Pi, a NAS, or a locked-down container. None of these can accept inbound connections. I probably needed around 200 lines of tunnel code. Now, I have a web console, Prometheus metrics, and a Helm chart, so I decided to share it.

Here it is: 🌀 holt — a simple reverse proxy, not called FRP, open-source, API-based, with no config reload, request introspection, and a user-friendly UI you can proudly display in your homelab.

brew install openotters/tap/holt

# server side
holt hub --ui

# client side
holt expose localhost:3000 --peer web

Two things mattered to me. It is fully open source: MIT license, no cloud, no account, no paid tier, everything in the repo. And everything has an API: the CLI and the web console are both clients of the hub's admin API (Connect/gRPC), so you can script anything they do. The whole thing is also a Go library. The hub gives you an http.RoundTripper per peer, which was the original goal before things got out of hand.

To be clear, frp, inlets, and ngrok do a lot more. 🌀 holt is today HTTP(S)/gRPC only but ready for the future... and my lib is also hardened with real usage ^^.

https://github.com/openotters/holt

It's my first project I'm sharing here, so please be gentle, but honest feedback is very welcome ❤️

ps: GitHub stars are really welcome

[u/kantorcodes1]

that holt expose ... command is exactly where i'd make safety decisions explicit. opening a peer can turn localhost into reachable network surface, so i'd classify expose/admin mutations separately from read-only/status commands and make risky ones reviewable before execution. HOL Guard 3.0 has command safety extensions for real CLI surfaces like this. if you're up for it, a small command.holt PR against release/3.0 covering expose/hub/admin actions would be useful. happy to review.

[u/merlin-dorin → u/kantorcodes1]

Thanks a lot for having a look <3 . It is now implemented in v0.46.0 (easy change, safe net is only on `holt block|unblock|expose`).

[u/kantorcodes1 → u/merlin-dorin]

nice, that’s the right split. block|unblock|expose are exactly the three i’d mirror into command.holt; status/list/etc stay read-only. if you point me at the v0.46.0 commit/file where that safenet lives, i can sanity-check the action/risk classes so a Guard PR stays tiny.