Tunnels

A tunnel creates a secure, public URL that allows external services and devices to reach your RTILA X instance over the internet. By default, RTILA X only listens on localhost (127.0.0.1), which means only applications running on the same computer can communicate with it. A tunnel bridges this gap by creating a publicly accessible URL that forwards traffic to your local RTILA X instance.

Tunnels are essential for:

Remote execution — Triggering automations from external services (Zapier, Make.com, scripts)
Mobile access — Controlling RTILA X from your phone via Telegram
Team collaboration — Allowing team members on different networks to trigger your automations
Webhook integration — Receiving webhooks from external services

Public tunnel architecture showing traffic flowing from the internet through Cloudflare to your local RTILA X instance

Public Tunnel (Cloudflared)

RTILA X uses Cloudflared (Cloudflare’s tunnel client) to create public tunnels. Cloudflare Tunnel is a free, secure tunneling service that routes traffic from the internet to your local machine without requiring you to open ports on your router or configure DNS.

How It Works

You enable the Public Tunnel in Preferences.
RTILA X launches the bundled rtila-cloudflared binary.
Cloudflared establishes an encrypted outbound connection to Cloudflare’s edge network.
Cloudflare assigns a random public URL (e.g., https://random-xyz.trycloudflare.com).
All traffic sent to this URL is forwarded through the tunnel to your local RTILA X instance at http://127.0.0.1:8880.
Your automation’s API becomes accessible from anywhere in the world.

Internet User / External Service
        │
        ▼
https://random-xyz.trycloudflare.com
        │
        ▼ (encrypted tunnel via Cloudflare edge)
        │
Cloudflare Edge Network
        │
        ▼ (secure tunnel)
        │
Your Computer (localhost:8880)
        │
        ▼
RTILA X API

Key Characteristics

Characteristic	Details
Protocol	HTTPS (encrypted end-to-end)
URL format	`https://random-words.trycloudflare.com`
Port forwarding	Not required — uses outbound connections only
Firewall	No router configuration needed
Cost	Free (Cloudflare provides this service at no charge)
Bandwidth	Unlimited for reasonable use

URL Format

The tunnel URL follows this pattern:

https://<random-words>.trycloudflare.com

Examples:

https://brave-fox-jump.trycloudflare.com
https://sunny-lake-dance.trycloudflare.com
https://purple-mountain-run.trycloudflare.com

The random words are generated by Cloudflare each time a tunnel is created. The URL is not predictable or guessable.

Enabling the Public Tunnel

Steps

Click your profile name in the bottom-left sidebar.
Click Preferences.
Go to the General tab.
Find the Remote Execution Tunnel section.
Toggle Enable Public URL for Remote Execution to On.
RTILA X starts the tunnel and generates a public URL.
The URL appears in the field below the toggle.

General settings showing the Remote Execution Tunnel section with the enable toggle and public URL

What Happens When You Enable the Tunnel

RTILA X launches the bundled rtila-cloudflared sidecar process.
Cloudflared connects to Cloudflare’s edge network.
A random public URL is generated.
The URL is displayed in the Preferences UI.
A toast notification appears confirming the tunnel is active.

What Happens When You Disable the Tunnel

The rtila-cloudflared process is terminated.
The public URL stops working immediately.
The URL field in Preferences is cleared.

What Happens When You Restart RTILA X

When you restart RTILA X (or close and reopen it):

If the tunnel was enabled, RTILA X automatically starts a new tunnel.
A new URL is generated — the old URL stops working.
A toast notification shows the new URL.

Important: The tunnel URL changes every time RTILA X restarts or the tunnel is toggled off and on. If you’ve shared the URL with external services, you’ll need to update them with the new URL.

Using the Tunnel URL

Once the tunnel is active, you can use the public URL anywhere you would use the local URL:

Purpose	Local URL	Public Tunnel URL
Remote execution API	`http://127.0.0.1:8880/api/remote`	`https://random-xyz.trycloudflare.com/api/remote`
Webhook receiver	`http://127.0.0.1:8880/api/rtila/webhook/{chain_id}`	`https://random-xyz.trycloudflare.com/api/rtila/webhook/{chain_id}`
Health check	`http://127.0.0.1:8880/api/health`	`https://random-xyz.trycloudflare.com/api/health`

Example: Remote Execution via Tunnel

curl -X POST 'https://brave-fox-jump.trycloudflare.com/api/remote' \
  -H "Authorization: Bearer YOUR_SESSION_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "api_key": "YOUR_PROJECT_API_KEY",
    "variables": {"query": "web scraping"}
  }'

Example: Webhook via Tunnel

curl -X POST 'https://brave-fox-jump.trycloudflare.com/api/rtila/webhook/chain123' \
  -H "X-Api-Key: YOUR_CHAIN_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "input_payload": {"data": "value"}
  }'

Tunnel Behavior Details

Automatic Restart on Profile Switch

When you switch profiles in RTILA X, the tunnel is automatically restarted:

The existing tunnel is stopped.
A new tunnel is started.
A new URL is generated.
A toast notification shows the new URL: “Remote tunnel restarted. Your new remote URL is: https://new-url.trycloudflare.com”

Tunnel on Logout

When you log out of RTILA X, the tunnel is automatically stopped.

Tunnel on App Close

When you close the RTILA X window (it goes to the system tray), the tunnel is stopped. When you reopen the window, the tunnel is restarted with a new URL.

Persistent URL (DuckDNS)

Note: Persistent URL support via DuckDNS is available as a configuration option in Preferences.

If you need a URL that doesn’t change when RTILA X restarts, you can use DuckDNS (a free dynamic DNS service) in combination with the public tunnel.

What Is DuckDNS?

DuckDNS is a free dynamic DNS service that gives you a subdomain (e.g., myrtila.duckdns.org) that always points to your computer’s public IP address. Unlike the trycloudflare.com URL, a DuckDNS URL stays the same.

Configuration

Go to duckdns.org and create a free account.
Create a subdomain (e.g., myrtila.duckdns.org).
Copy your DuckDNS token.
In RTILA X, go to Preferences → General.
Enable Persistent URL.
Enter your DuckDNS token and domain.

Limitations of DuckDNS

Limitation	Details
DuckDNS points to your public IP	Your router must forward port 8880 to your computer
Requires router configuration	You need to set up port forwarding on your router
Not encrypted by default	You’d need to set up HTTPS separately
DuckDNS must be updated	Your computer must periodically update DuckDNS with your current IP

Tip: For most users, the Cloudflare tunnel (trycloudflare.com) is simpler and more secure because it requires no router configuration and provides HTTPS automatically. Use DuckDNS only if you specifically need a persistent URL.

Tunnel Limitations

Limitation	Details	Workaround
URL changes on restart	The trycloudflare.com URL changes every time RTILA X restarts	Use DuckDNS for a persistent URL, or update your external service’s URL after each restart
URL changes on toggle	Turning the tunnel off and on generates a new URL	Keep the tunnel enabled if you need continuous access
Requires internet	The tunnel requires an active internet connection	No workaround — the tunnel needs internet to work
Cloudflare rate limits	Very high traffic may be rate-limited by Cloudflare	For production use, consider a dedicated server
No custom domain	The trycloudflare.com domain cannot be customized	Use DuckDNS or a reverse proxy for custom domains
Session token still required	The tunnel only exposes the API. You still need a valid session token in the Authorization header.	Keep your session token secure
Temporary by nature	trycloudflare.com tunnels are designed for temporary use	For long-term production use, consider deploying RTILA X on a server

Security Considerations

Consideration	Recommendation
The tunnel URL is public	Anyone who knows the URL can send requests to your API. The API key is the only protection for remote execution.
API key is the gatekeeper	Without the correct API key, remote execution requests are rejected. Keep your API key secret.
HTTPS is automatic	All traffic through the tunnel is encrypted via HTTPS. No additional SSL configuration is needed.
No port forwarding	Unlike traditional setups, you don’t need to open any ports on your router. This reduces your attack surface.
Disable when not needed	If you don’t need remote access, disable the tunnel. This removes the public URL entirely.
Monitor for unexpected access	Check your execution logs for any unexpected remote triggers.
Regenerate API keys if compromised	If you suspect your API key has been exposed, regenerate it immediately.

Tunnel Status in the UI

The tunnel status is reflected in several places in the RTILA X interface:

Location	What It Shows
Preferences → General	The enable/disable toggle and the current public URL
Remote Execution modal	Shows the public URL when the tunnel is enabled
Toast notifications	Notifications when the tunnel starts, restarts, or fails

Troubleshooting

Problem	Cause	Solution
Tunnel won’t start	Internet connection issue	Check your internet connection
URL not appearing	Cloudflared failed to connect	Restart RTILA X and try again
URL stops working	RTILA X was restarted	A new URL is generated. Check Preferences for the new URL.
External service can’t reach the URL	URL changed after restart	Update the external service with the new URL
Slow response through tunnel	Network latency	Tunnel traffic goes through Cloudflare’s edge, which adds slight latency. This is normal.
“Failed to start public tunnel” error	Cloudflared binary issue	Restart RTILA X. If the problem persists, reinstall RTILA X.
Tunnel URL works locally but not externally	Firewall or network issue	Check your firewall settings. The tunnel uses outbound connections, so most firewalls should allow it.