Use Inletsctl

Using inletsctl

Automate provisioning of inlets exit-servers (tunnel servers) on cloud infrastructure.

Docs: https://docs.inlets.dev/reference/inletsctl/ Source: https://github.com/inlets/inletsctl

Download inlets-pro binary

inletsctl download

# Specific version
inletsctl download --version 0.9.40

Creating Exit-Servers

Either --letsencrypt-domain (for HTTPS) or --tcp (for TCP) must be specified.

HTTPS tunnel with Let's Encrypt

Terminates TLS at the exit-server with automatic Let's Encrypt certificates:

inletsctl create my-tunnel \
  --provider digitalocean \
  --region lon1 \
  --access-token-file $HOME/do-access-token \
  --letsencrypt-domain app.example.com \
  --letsencrypt-issuer prod

Multiple domains on the same tunnel:

inletsctl create my-tunnel \
  --letsencrypt-domain app1.example.com \
  --letsencrypt-domain app2.example.com

TCP tunnel

For raw TCP traffic (SSH, databases, etc.):

inletsctl create my-tcp-tunnel \
  --tcp \
  --provider digitalocean \
  --region lon1 \
  --access-token-file $HOME/do-access-token

If no name argument is given, a random name is generated.

After creation, inletsctl prints a connection command with the server IP and auth token. Run that command locally, updating --upstream and --ports as needed.

Deleting Exit-Servers

Delete by ID or IP (both are printed at creation time):

# By ID
inletsctl delete --provider digitalocean \
  --access-token-file $HOME/do-access-token \
  --id 164857028

# By IP
inletsctl delete --provider digitalocean \
  --access-token-file $HOME/do-access-token \
  --ip 209.97.131.180

Forwarding Kubernetes Services Locally

Forward a Kubernetes service to your local machine:

# HTTP service
inletsctl kfwd --from my-service:8080 --if 192.168.0.14

# TCP service
inletsctl kfwd --from nats:4222 --if 192.168.0.14 --tcp

--if must be an IP on your machine reachable from the cluster. Use --namespace for non-default namespaces.

Supported Providers and Defaults

Provider-Specific Configuration

DigitalOcean

inletsctl create my-tunnel \
  --provider digitalocean \
  --region lon1 \
  --access-token-file $HOME/do-access-token \
  --tcp

AWS EC2

Required: --access-token-file (access key) and --secret-key-file (secret key).

inletsctl create my-tunnel \
  --provider ec2 \
  --region eu-west-1 \
  --access-token-file ./access-key.txt \
  --secret-key-file ./secret-key.txt \
  --tcp

With temporary credentials (STS), add --session-token-file ./session-token.txt.

Optional: --vpc-id and --subnet-id (both must be set together), --aws-key-name.

Google Compute Engine (GCE)

Required: --project-id and --region (no default region). --access-token-file takes a service account key JSON.

inletsctl create my-tunnel \
  --provider gce \
  --project-id $PROJECTID \
  --region us-central1 \
  --access-token-file key.json \
  --zone us-central1-a \
  --tcp

Default zone: us-central1-a. GCE VMs get ephemeral IPs — reserve a static IP for a stable tunnel address.

Azure

Required: --subscription-id. --access-token-file takes a service principal JSON (az ad sp create-for-rbac --sdk-auth).

inletsctl create my-tunnel \
  --provider azure \
  --region eastus \
  --subscription-id $SUBSCRIPTION_ID \
  --access-token-file ~/client_credentials.json \
  --tcp

Linode

inletsctl create my-tunnel \
  --provider linode \
  --region us-east \
  --access-token $TOKEN \
  --tcp

Hetzner

Regions: hel1 (Helsinki, default), nur1 (Nuremberg), fsn1 (Falkenstein).

inletsctl create my-tunnel \
  --provider hetzner \
  --region hel1 \
  --access-token $TOKEN \
  --tcp

Scaleway

Required: --secret-key and --organisation-id. Region fixed to fr-par-1.

inletsctl create my-tunnel \
  --provider scaleway \
  --access-token $TOKEN \
  --secret-key $SECRET_KEY \
  --organisation-id $ORG_ID \
  --tcp

OVHcloud

Required: --secret-key, --consumer-key, and --project-id.

Endpoints: ovh-eu (default), ovh-us, ovh-ca, soyoustart-eu, soyoustart-ca, kimsufi-eu, kimsufi-ca.

inletsctl create my-tunnel \
  --provider ovh \
  --access-token $APPLICATION_KEY \
  --secret-key $APPLICATION_SECRET \
  --consumer-key $CONSUMER_KEY \
  --project-id $PROJECT_ID \
  --endpoint ovh-eu \
  --tcp

Vultr

Default region: LHR (London).

inletsctl create my-tunnel \
  --provider vultr \
  --region LHR \
  --access-token $TOKEN \
  --tcp

Key Flags Reference