Expose services

Mesh devices can always reach each other at device.mesh:port — no setup needed. Use jalth serve when you need public internet access with HTTPS, edge protection, and optional identity gates.

When to use serve vs direct mesh access

	Direct mesh	`jalth serve`
Access	Mesh members only	Anyone (or restricted via `--allow`)
HTTPS	No (raw TCP)	Yes (Universal SSL)
CDN/WAF/DDoS	No	Yes, included free
Identity gate	No	Optional `--allow` policies
Setup	None	One command

Basic usage

jalth serve nginx --port 8080

Creates:

Public URL: https://nginx.myteam.com
Cloudflare Tunnel route to localhost:8080
Proxied DNS CNAME + Universal SSL certificate

With access control

jalth serve grafana --port 3000 --allow group:devs
jalth serve api --port 3000 --allow email:alice@team.com --allow group:engineers

Only matching identities can access the URL. Powered by Cloudflare Access.

More examples

# TCP protocol (e.g. database)
jalth serve postgres --port 5432 --proto tcp

# List all services across the mesh
jalth serve ls

# Stop a service
jalth stop nginx

# Ephemeral public URL (no domain, no Access)
jalth serve demo --port 3000 --quick

Domain requirement

Publishing on {name}.{domain} requires a mesh domain. Set during init or later:

jalth domain set myteam.com

Without a domain:

SSO admin (interactive) — Inline zone picker lists your Cloudflare zones.
Headless / non-admin — Offers a quick tunnel as a fallback.
Non-interactive — Fails with a structured error; pass --quick or set domain first.

What happens under the hood

Ensures a cloudflared tunnel exists on this device (created lazily on first serve)
Worker creates tunnel ingress rule, DNS CNAME, and Access app (if --allow set)
cloudflared starts routing traffic from the edge to your local port

Stop and cleanup

jalth stop nginx

Removes tunnel ingress, DNS record, and Access app. The underlying tunnel persists for other services on the same device.