Tunnels and connectivity

No static IP. No domain of your own. Your service lives behind your provider’s NAT. Naasson Edge routes it through its network and gives you a stable subdomain with TLS under the hood. If you want a free alternative — peer-mesh via self-hosted Headscale.

$ weldctl tunnel up --mode edge --service localhost:3000
edge: registered as 7f2a9c.cloud.naasson.com
edge: tls issued (Let’s Encrypt, CT-logged)
edge: ready, traffic accepted
$ weldctl tunnel up --mode mesh --peers home,laptop,vps
mesh: headscale-server bootstrapped
mesh: 3 peers joined, 100.64.0.{2,3,4}

weldctl tunnel up — Edge or Headscale, one interface.

My tunnels Install weldctl

Naasson Edge — paid tunnel

Your VM registers with the Edge Controller through WireGuard and gets a subdomain under cloud.naasson.com within seconds. Encrypted traffic flows through the edge layer — your VM IP is not exposed. A TLS certificate is issued automatically. The subdomain survives an edge-node failure: traffic moves to the next healthy node, your user’s DNS does not change. Paid — the more traffic, the more NC.

P2P via Headscale — free

If you do not need a public entry point and a mesh network between your own devices is enough — Headscale solves that for free. weldctl brings up a self-hosted Headscale server on your machine, nodes connect over WireGuard, DNS and certificates are your responsibility. This is Mode 1, peer-mesh: stays inside a single user boundary, no Cloud Naasson account required.

Which to pick

Need a public URL for friends or clients, without owning a domain and without wrestling with Let’s Encrypt — Edge. Need a private mesh between a laptop, a home server and a couple of VPS — Headscale. Nothing stops you using both: the public service through Edge, internal admin access through the mesh.