New features, releases and engineering deep dives from the Tuna tunneling service.
The new inspector, with an API for AI agents
AI agents read the tuna-cli 0.40 inspector through an API, find a failed request, replay it, and wait for a webhook. The inspector also shows requests rejected by policies and authorization, plus PostgreSQL, MySQL, and Redis sessions.
read →☸️ Tuna Kubernetes operator — tunnels, domains, and Ingress as cluster resources
The operator publishes cluster Services through Tuna tunnels. Ready-made Helm charts work via Ingress with the tuna class, each tunnel gets its own key, and no LoadBalancer, public IP, or open ports are needed.
🕸️ Tuna Mesh in beta — a private network for your devices
A new Mesh section has appeared in the dashboard. Laptops, servers, and VMs are connected into a private network with persistent addresses and DNS names. The firewall runs on our nodes, and if a provider blocks WireGuard, the network falls back to SSH.
🔐 Secrets change requests — prod edits through review
A member without environment access can propose secret changes, and an environment editor reviews, approves, and applies them. Approval policies define how many approvals are needed and from whom.
🌐 Apex domain with fault tolerance
An apex domain like example.com cannot use a CNAME, so it had no fault tolerance. Now the dashboard offers to host the site on a subdomain while Tuna sets up the redirect from the apex automatically.
🔑 Session sign-in and API keys instead of a token
tuna-cli 0.39 signs into your account via a device session, and for CI, servers, and services, API keys replace the Tuna Token. The old token continues to work. Here is what changed and what to do if you have CI, a server, or a background service.
🖥️ tuna-cli 0.39 — terminal UI for every command
The full-screen terminal UI is now available for tuna start, run, app, trigger, and for domain, port, tunnel, API key, monitor, and SSH session management commands. The inspector can be toggled without restarting the tunnel.
🐟 Tuna Desktop 0.3 — session sign-in and any domain for tunnels
Tuna Desktop 0.3 signs into your account via a device session, like tuna-cli 0.39, and accepts an API key instead of a token. The tunnel form now has a "Domain" field instead of a static subdomain, supporting any of your domains. Plus update notifications with a ready-made command for your system and DNS checks in diagnostics.
🤖 Docs that are easy for agents to read: llms.txt and Markdown copies of pages
Every page of the Tuna docs has a Markdown copy, and the table of contents for the whole documentation lives in llms.txt. Here's why agents need this, how it works on our side, which pitfalls we ran into and how to do the same on your own Docusaurus site.
📰 What's new in Tuna — dark theme, firewall addresses, and Linux package migration
Linux packages for tuna are now only in code.tuna.am, the dashboard got a dark theme, and the list of Tuna addresses for corporate firewalls is available via API. Plus CLI fixes.
🛡 What to patch now: PHP, GitLab, Node.js, Brotli and eMudhra
A rundown of October's vulnerabilities — PHP2Shell, two 10-out-of-10 flaws in GitLab, code execution through the Brotli decoder and the guessable keys of the eMudhra certificate authority. Which versions to install, what to do if you can't update right now, and where to read more.
🦎 Tunnels are now highly available
We've spread traffic entry points and tunnel nodes across different servers, data centers and countries. A single server failure no longer means downtime, you don't need to choose a region, and Telegram webhooks reach tunnels wherever the client runs.
🕵️ AIOps: our experience rolling out HolmesGPT across three projects
We connected the open-source SRE agent HolmesGPT to Alertmanager in six Kubernetes clusters. Here's how it works, what an alert investigation costs, how we chose models, what to do about sensitive data and which pitfalls we ran into.
📒 1C tunnel — your infobase on the internet with a single command
The new tuna 1c command publishes a 1C:Enterprise infobase and makes it reachable through the web client and the thin client — no web server to install and configure, no port forwarding and no public IP.
☸️ Kubernetes tunnel — temporary cluster access with a single link
The new tuna kubernetes command gives a colleague or contractor access to your cluster with plain kubectl — no VPN, no exposing the API server to the internet and no sharing your credentials. Access can be limited by namespace, resources and lifetime.
🎁 Free plan without a timer and with a permanent subdomain
HTTP tunnels on the free plan are no longer limited to 30 minutes, and every user now has their own permanent subdomain in the tuna.am zone — it is assigned automatically and stays the same across restarts.
🧑💻 Terraform provider for Tuna
Domains, domain zones, gateways, TCP ports, IP policies, certificates, and temporary tokens for Tuna can now be defined as code in Terraform and OpenTofu. And API keys now have per-product permissions.
🖥️ tuna-cli 0.36 — terminal UI and a major update
Tunnels in tuna-cli now show a full-screen interface with a request feed, metrics, and session viewer. Plus unix sockets, policy by URL, event data in trigger, a new secrets CLI, and upgrade hints.
🗝️ Secrets entirely from the console — a major tuna secrets update
In tuna-cli 0.35, tuna secrets learned to read and modify individual secrets, manage projects and environments, deliver secrets as a file without writing to disk, work offline, and compare values between environments without revealing them.
💳 International card payments — PayPro Global is now available
You can now pay for a Tuna subscription with a Visa or Mastercard issued outside of Russia. Payments in USD are processed by PayPro Global; Russian cards are still accepted via YooKassa.