Rift: Self‑Hosted QUIC Tunnel for Local Development

Rift is a small Go binary that provides a self‑hosted ngrok alternative built on QUIC. It runs as a server on a VPS and as a client on any private service, enabling the private service to be reachable from the public internet over HTTPS via a single QUIC connection. Rift’s architecture uses QUIC’s stream isolation to prevent head‑of‑line blocking and connection migration to survive network changes. The server listens on UDP/443 for QUIC and TCP/443 for HTTPS, terminating TLS 1.3 in the handshake. Each client authenticates with a single bearer token; the default token TTL is one hour, but can be set to never expire. Tokens are provisioned offline via BadgerDB or online via a loopback‑only admin endpoint, which is rate‑limited to 5 requests per minute. Rift supports both HTTP and TCP tunnels through the --expose flag, assigning subdomains for HTTP and configurable ports for TCP. No accounts, telemetry, or public control plane are required, giving users full ownership of the data path. The implementation uses quic-go for the QUIC stack.

Deploying Rift involves launching the server on a VPS, generating a bearer token, and running the client with --expose to expose local ports. The client establishes a long‑lived QUIC stream to the server, which forwards requests to the local service and returns responses over the same stream. The design eliminates the need for port forwarding or inbound firewall rules, making it ideal for sharing dev servers, testing webhooks, and demoing work in progress.