tcptun

Architecture

Compile before serve.

How tcptun compiles FileConfig into a fail-closed networking runtime: validation, RuntimeConfig, TCP/UDP/TUN, and routing.

Go SDKConfigurationSource

Pipeline

From FileConfig to networking runtime.

Configuration (JSON)
        |
        v
    FileConfig
        |
     validate
        |
     compile
        |
   RuntimeConfig
        |
        v
 Networking Runtime
   |      |      |      |
  TCP    UDP    TUN   Routing
Stage01

FileConfig

Strict JSON topology with unknown-field rejection. Inbounds, outbounds, route, DNS, and resource budgets.

Stage02

Validate

Unique tags, reference integrity, auth material, transport/security combos, and capability checks before bind.

Stage03

Compile

Produce RuntimeConfig: compiled outbound graph, route table, and prepared listeners — not ad-hoc runtime parsing.

Stage04

Serve

One process serves TCP, UDP, TUN, reverse publish, and packet paths with shared routing and diagnostics.

Properties

Why the model builds trust.

Fail closed

Invalid config never partially starts. DNS fake-IP and routing refuse unsafe fallbacks when validation fails.

Deterministic routing

Rules and default_outbound are compiled; balance and chain hops are cycle-checked and finite.

Resource bounds

Mux pools, resume buffers, and packet paths use explicit budgets so memory behavior stays predictable.

Observable runtime

Log levels, bridge identity, and runtime statistics surface for operators and embedders.

Surfaces

Same runtime, multiple hosts.

CLI loads FileConfig. Embedders construct the engine packages directly. Android bridge injects TUN and control plane hooks. The compiled model stays the same.

EmbedUse cases