Desktop App & Web UI

The desktop app and the CLI are two front-ends over the same uplink-core crate, so they share one login profile, local state, tunnel set, request inspector, edge registry, and rule registries. Anything you do in one shows up in the other.

Desktop app

A Tauri macOS app that hosts the shared React/TypeScript UI. Run it from the uplink repo root with:

pnpm install --frozen-lockfile
pnpm -C app/desktop tauri dev

The UI covers tunnel management and add/detail flows — including each app’s access (choose a personal or organization owner, invite people, set a token, or restrict access by source IP) and firewall settings (a base request limit and reusable rules). Tunnel fields save automatically. Each tunnel’s address segment opens a publish menu (“Choose where this tunnel is published”): pin a managed region or self-hosted edge, “Select closest” to measure and pin the fastest, or assign/clear a verified managed-account custom-domain alias. Standalone aliases are configured by the edge operator and do not appear in this picker. The UI also includes settings, email-code sign-in, the traffic inspector, the edge registry, and reusable firewall-rule registries. Inline firewall_rules: from uplink.yaml sync into the same registry the desktop app reads.

View YAML emits portable configuration rather than internal state: personal ownership is omitted, organizations are written by stable slug, and a managed plan’s maximum bandwidth is omitted unless you selected a genuine lower cap.

Background serving

The desktop dashboard and the local serving agent have separate lifecycles. Closing the dashboard window leaves enabled tunnels serving and keeps Uplink in the system menu bar or tray, where its current tunnel count remains visible. Use Stop All Tunnels there or the main serving switch to take every public URL on the device offline.

An explicit Quit Uplink while tunnels are live asks whether to keep serving or stop all tunnels first. The default can be changed under Settings → Background serving. That section can also start Uplink at login; login launches it directly into the menu bar and resumes tunnels that were left enabled.

The agent is shared with the CLI, so Stop All Tunnels means the whole device, including tunnels started from uplink serve or uplink up. Closing only the dashboard never interrupts that shared formation.

Because the app already supervises that shared agent, don’t also install the system service on the same machine — uplink service install refuses the combination. That command belongs on headless, CLI-only hosts; see uplink service.

Headless web UI (uplink ui)

uplink ui serves the same UI over HTTP — useful on a server or in a container with no desktop.

uplink ui                                   # binds 127.0.0.1:4800
uplink ui --port 4801
uplink ui --tunnel                          # publish the UI through an Uplink tunnel
uplink ui --tunnel --auth s3cr3t -d         # tokened, detached in the background

The local server always binds 127.0.0.1 and does no authentication of its own — like the desktop app, whoever can reach the port is trusted. Remote access goes through --tunnel, which publishes the UI as an edge-gated Uplink tunnel: your account sign-in admits you, and --auth/--auth-file adds an access token — required on a self-hosted edge, which cannot verify account sign-ins. --tunnel-name sets the tunnel’s app name (default uplink-ui). Without -d, the tunnel is removed on Ctrl-C; with -d/--detach (requires --tunnel) a background process keeps serving until uplink stop <name>, uplink stop --all, or uplink down.