Skip to content
HomeRoot
Sign in

Expose your homelab. Keep ports closed.

HomeRoot publishes services from your homelab through an encrypted tunnel that your own network opens. No port forwarding, no static IP, and no dynamic-DNS workarounds.

What you can publish

WebHHomepublicWireGuardopened by your agent
Public address
https://grafana.your-zone
Inside your network
localhost:3000

HTTPS at the edge with a wildcard certificate for the zone. Example values.

  • 0open router ports
  • 4agent builds: Linux and Windows, x86-64 and ARM64
  • 5 GiBedge cache for shared files
  • 1binary for panel, API and DNS

Why not just forward a port?

Flip the switch and compare. Then follow a single request from the internet to your machine.

  • Inbound ports on the router3 open
  • Your public IPExposed
  • CertificatesYour job
  • When the IP changesLinks break

Follow one request

  1. Internet
  2. HomeRoot edge · HTTPS
  3. WireGuard tunnel
  4. Your agent
  5. localhost:8123

Simulation. Nothing is connected. Public ports are assigned automatically from 30000–50000.

Your network stays as it is.

Everything HomeRoot does happens through connections your devices open. Your router keeps its configuration.

Your router keeps every port closed.

The agent connects out to HomeRoot, and services are published through that connection. There is no port forwarding to set up and no firewall rule to maintain.

0inbound ports opened on your router

Names that follow your address.

Claim a DynDNS name in a zone you control. A personal update URL keeps the record current from a router, a script or a cron job.

nas.your-zone.net A record

*/5 * * * * curl -4 -fsS 'https://ipv4.your-zone.net/api/v1/ddns/<token>/ipv4'

HTTPS certificates without the chores.

Each zone gets a wildcard certificate. HomeRoot answers the DNS-01 challenge with its own nameserver, and renewal runs in the background.

  • Wildcard certificate per zone
  • DNS-01 challenge answered by HomeRoot
  • Renewal without manual steps

Share a file as a link.

Publish a file from any device as a direct download. Popular files are served from an edge cache of up to 5 GiB.

  • One subdomain per shared file
  • Range requests and ETags for resumable downloads
  • Cached copies kept for up to 24 hours

Three steps from the panel to a public service.

  1. Create a device

    The panel gives the device a token and an install command for Linux or Windows.

  2. Run the install command

    The agent installs as a service and connects out to HomeRoot. The device shows as online in the panel.

  3. Publish a service

    Forward a local port, add a website, claim a DynDNS name or share a file. Your router stays as it is.

$

The panel fills in your device token. Example output.

Common targets
  • Home Assistant
  • Grafana
  • NAS web interfaces
  • Game servers
  • Files you hand out

Questions people ask first.

Do I have to open ports on my router?

No. The agent makes an outbound connection to HomeRoot, and services are published through that connection. Nothing on your router accepts connections from the internet.

Does it work with a dynamic IP address or behind CGNAT?

Yes. Because the agent connects out, the address of your connection does not matter for publishing a service. DynDNS names follow a changing address through an update URL that a router, a script or a cron job can call.

How is the traffic protected?

The link between your device and HomeRoot is a WireGuard tunnel. Websites are served over HTTPS with certificates for your zone. Traffic to your local service stays inside the tunnel.

Which systems does the agent run on?

Linux and Windows, on x86-64 and ARM64.

What do the limits depend on?

Your package. Limits cover the number of devices, tunnels, DynDNS names and websites, and the traffic per accounting period.

Can I run my own instance?

Yes. HomeRoot is a single Go binary that includes the web panel, the API and the authoritative DNS server.

Keep the ports closed.

Sign in and publish your first service from the panel.

Loading sign-in options…