Publish from local
OVXO opens controlled QUIC tunnels straight from your machine or cluster and gives each approved service a public hostname.
Local Global Soon
Local deploys, public URLs, nothing extra exposed
Publish local apps to the internet. Keep the source on your machine.
OVXO opens controlled QUIC tunnels from your machine or cluster and gives each approved service a public hostname — every tunnel key is checked before edge traffic is accepted.
Source stays local · Passkey login · Approve per service
ovxo-cli deploy local ./MyProject --tunnel project MyProject web web.MyProject.app.ovxo.de gateway gateway.MyProject.app.ovxo.de publish selected services only transport quic_udp billing checked
web.MyProject.app.ovxo.de — public
gateway.MyProject.app.ovxo.de — public
Where OVXO gets used
Reach for OVXO the moment something needs to leave localhost.
Client demos
Share a build that's still running on your laptop — no deploy, no screen share.
Webhook testing
Point a real provider at a real public endpoint. No manual port forwarding.
Branch previews
Let a teammate look at a branch before it touches a shared environment.
Devices behind NAT
Reach a Pi, an edge box, or a lab machine without opening your router.
Project graph aware
The CLI reads your project once — apps, services, SDKs, protocols, ports, add-ons — before anything is offered for publishing.
Billing gate first
Every tunnel key is checked against the OVXO control API before edge traffic reaches it. Nothing serves on an unverified key.
Before / after
What changes once a service is on OVXO.
Local only
With OVXO
Reachable only at localhost:PORT
A stable public hostname per service
Ports opened and forwarded by hand
Publish decided per service, from the console
Anyone with the link sees the whole box
Only the services you approve are public
Tunnel dies the moment the process does
Keys verified before edge traffic is ever accepted
Publish flow
1
Login with passkey WebAuthn sign-in — no password to type or leak.
2
Scan the project graph The CLI reads your project once and maps every service, port, and SDK.
3
Choose what becomes public Approve services one by one. Everything else stays on localhost.
4
Serve through OVXO edge Approved services get a stable hostname, routed over QUIC.
Security
Nothing is public until you say so.
OVXO tunnels traffic, not files. Builds and source stay wherever you're running them — only the hostnames you approve exist on the public internet.
Verified before it serves
Tunnel keys are checked against the OVXO control API before edge traffic is accepted.
Opt-in by service
Publishing is a decision per service, not per machine. Everything else stays on localhost.
Passkey sign-in
WebAuthn only — no password sitting in a database or a browser autofill to leak.
Source never uploaded
The CLI tunnels connections outward. It doesn't ship your code anywhere.
Coming next
Global modeDeploy without a local machine at all.
Global skips the tunnel entirely. Point OVXO at your project and it runs in managed containers — controlled from the same console you already use for Local.
No machine required
Nothing has to stay running on your laptop or cluster for the app to stay up.
Same console
Same publish control and hostnames — just backed by containers instead of a tunnel.
Point and deploy
OVXO places the project in a container and runs it — no tunnel to open.
Questions
Before you open a tunnel
Does my source code ever leave my machine?
No. OVXO tunnels network traffic, not files — your build and source stay wherever they already are.
What's public by default?
Nothing. Each service is only reachable once you approve it in the console.
Why QUIC instead of a plain TCP tunnel?
Faster connection setup and better recovery on flaky networks, without one slow stream blocking the rest.
How do I sign in?
With a passkey. There's no password to set, type, or leak.
Can I take a service back offline?
Yes — flip it private again from the console any time.
Start here
Your local app already runs. Give it an address.
Scan your project, approve what should be public, and OVXO handles the hostname and the tunnel.
Works with what's already running — no code changes to publish.