Tunnel

Install the customer-side agent that exposes local Ollama, oMLX, or vLLM to Fallbakit without opening the runtime to the internet.

What the tunnel does

The tunnel agent runs beside the customer's local runtime. It opens an outbound WebSocket session to wss://api.fallbakit.com/tunnel, registers the runner for the customer's account, and forwards selected requests to the configured local API.

Requirements

A supported local runtime reachable from the agent host.
A runner created in the dashboard.
The generated RUNNER_ID and one-time RUNNER_API_KEY.
Outbound HTTPS/WebSocket access to api.fallbakit.com.

Supported local providers

Provider	Typical base URL	Readiness probe
`ollama`	`http://localhost:11434`	`GET /api/tags`
`omlx`	`http://localhost:8000`	`GET /v1/models`
`vllm`	`http://localhost:8000`	`GET /v1/models`

Use the provider selector and generic base URL:

FALLBAKIT_LOCAL_PROVIDER=ollama|omlx|vllm
FALLBAKIT_LOCAL_BASE_URL=http://localhost:11434
FALLBAKIT_LOCAL_API_KEY=optional_local_runtime_key

FALLBAKIT_OLLAMA_URL still works as a backward-compatible alias when FALLBAKIT_LOCAL_PROVIDER=ollama, but new setups should prefer FALLBAKIT_LOCAL_BASE_URL.

For vLLM, direct OpenAI clients usually use http://localhost:8000/v1; the Fallbakit agent should use http://localhost:8000 without /v1 because Fallbakit adds /v1/chat/completions and /v1/models.

Installation paths

Docker: run the agent as one container beside a host runtime.
Docker Compose: keep the agent in Compose, with optional Ollama sidecar examples.
Kubernetes: deploy the agent with ConfigMap and Secret wiring.
Go Binary: run the agent directly with flags, env vars, or YAML config.

Health checks

After the agent connects, open Dashboard -> Runners. A healthy runner shows connection state, probe status, latency, last probe time, and whether it is the selected local route.

Updates

The open-source tunnel agent verifies signed updates before installation. Use pinned releases for production and rotate runner keys when replacing customer machines.