Publish a local app

from localhost to https, in three commands

Janus turns a Holesail public key into a public HTTPS site. Your app keeps running on your own machine; nothing is uploaded, and visitors install nothing.

1. Run your app

Start it however you normally would and note the port. Binding to 127.0.0.1 is fine — you do not need to expose it on 0.0.0.0.

2. Publish the port

npx holesail --live 3000 --public

The --public flag is required. Without it Holesail prints an s000 private key, which is the serve credential — it lets the holder impersonate your backend. This gateway refuses those on purpose, so a key without --public gets you a 400 and nothing else.

3. Open the link

Holesail prints hs://0000…. Everything after hs:// is your subdomain:

https://0000<your-key>.janus.ssani.dev/

The key is the password

There is no other access control. Anyone holding that URL reaches your app exactly as you left it — and a local dev server usually has no login at all, so “anyone” means full access to whatever it can read, write, or spend.

• The key travels in the TLS SNI field, which is not encrypted, and lands in browser history, bookmarks and Referer headers sent to third-party sites.
• Treat the URL as a bearer token. Don't post it anywhere public.
• Stopping the local process revokes it. The key changes on the next start unless you pass a fixed seed.

When something breaks

• 400 — the key is malformed, or it's an s000 secure key. Re-run step 2 with --public.
• 502 — the gateway found your key on the DHT but your app didn't answer. Check the local process is still up and that you published the right port.
• 503 — the gateway is at tunnel capacity, or it has recently failed to reach this backend and is backing off. Retry.
• 429 — you're being rate limited. Slow down.
• Nothing happens at all — holepunching needs outbound UDP. Symmetric NAT and CGNAT (common on mobile carriers, some ISPs, and locked-down office networks) can block it. This is a network condition, not a fault in your app; try another connection.

Framework notes

• Requests arrive with Host: 0000<key>.janus.ssani.dev. Dev servers that allowlist hostnames will reject that until you add it — server.allowedHosts in Vite, allowedHosts in webpack-dev-server, ALLOWED_HOSTS in Django.
• X-Forwarded-Proto arrives as https,http, because two proxies each append a value. Read the leftmost entry; an exact comparison against "https" will fail and can send a framework into a redirect loop.
• WebSockets work. Connect to wss:// on the same hostname.

Machine-readable version for an AI assistant: /llms.txt