Seikan is a self-hosted tunneling reverse proxy — an ngrok replacement — with automatic Let's Encrypt.

A public server exposes services running behind NAT/firewalls through a long-lived outbound tunnel from a client. The client dials the server over one TLS connection multiplexed with yamux; the server terminates public HTTPS (per-domain Let's Encrypt certs) and raw TCP, and proxies each public connection over the tunnel to the client, which forwards it to a local address.

            :443 HTTPS (autocert)          tunnel :7000 (TLS+yamux)
 browser ───────────────────────► server ◄──────────────────────── client ──► localhost:3000
            Host: app.example.com    │  route Host→frontend→stream      (your machine)
 tcp     ───────────────────────►    │  per-frontend public TCP port
            :10000-20000             ▼  admin API on the admin host (Bearer key)

Two binaries, no external services. Secrets (API keys, connect tokens) are stored only as SHA-256 hashes in an embedded bbolt database.