Blog

Build logs, design notes, honest trade-offs.

Posts from the team building 21tunnel in the open. Every claim links back to a commit, a migration, or a design doc in the repo.

Share localhost with your team in 60 seconds.

The minimal setup: one command, HTTPS URL, works on any network. Then persistent URLs across restarts, OIDC gating, and 5 pitfalls to avoid.

Read post → Vikas Swaminh

HTTPS for localhost in 2026 — six ways compared.

Tunneling, mkcert, Caddy, Let’s Encrypt DNS-01, framework --https flags, old-school self-signed. When each works, gotchas that waste hours.

Read post → Vikas Swaminh

Test Stripe webhooks locally — the complete 2026 guide.

Stripe CLI forward vs a real tunnel, HMAC signature verification in Node / Python / Rust, idempotency via stripe_event_id UNIQUE, and graduating to production without redoing anything.

Read post → Vikas Swaminh

How to expose localhost to the internet — the complete 2026 guide.

Five real options: tunneling services, router port-forward + dyndns, mesh VPNs, cloud-proxy reverse SSH, WebRTC. Framework-specific notes for Next / Vite / Rails / Django / Flask / Express, plus the safety checklist.

Read post → Vikas Swaminh

7 free ngrok alternatives in 2026 — tested, scored, honest.

Every tunnel tool I could find that’s open-source or has a no-credit-card free tier. Cloudflare Tunnel, Tailscale Funnel, frp, localtunnel, bore, chisel, and 21tunnel — what each shines at, what each pinches on, and a one-liner for how to pick.

Read post → Vikas Swaminh

Why we rewrote the tunnel stack in Rust.

Every tunneling service in the market is Go. We picked Rust, forbid unsafe code, and denied unwrap, panic, and todo! at compile time. Why — and what that cost us.

Read post → Vikas Swaminh

ngrok alternative in 2026: an honest comparison.

Where ngrok genuinely wins, where the free-tier cap and custom-domain paywall pinch, and when to switch to an open-source, self-hostable alternative.

Read post → Vikas Swaminh

Building a self-hosted, multi-tenant tunnel service in four days.

argon2id, JWT+refresh rotation, RBAC with a superadmin bit, TOTP MFA, Stripe Checkout + Portal, and a dual-auth middleware that keeps ops scripts working. What the build actually looked like, day by day.

Read post → Vikas Swaminh