Serve a static folder

A static tunnel lets the agent serve a folder directly. Use it for a built site, documentation, or downloads; no local web server is needed.

Before you start

Put the files on the machine that will run the agent. Find the folder's absolute path, for example /home/alex/site/dist. A relative path such as ./dist is rejected. Put index.html at the folder root if you want a home page.

1. Create the tunnel

In the dashboard, create a tunnel with Backend mode: static and Target: /home/alex/site/dist (replace it with your absolute path). Copy the kpt_… agent token when it appears, and keep it private.

2. Run the agent

Install the agent on the machine holding the files:

curl -fsSL https://cdn.kepeink.hu/install.sh | sudo sh -s -- --token=kpt_xxxxxxxx

The agent service must be able to read the folder and its files. See Install the Agent for Windows or a foreground run.

Run with limited file access

If this machine holds sensitive data, you can run the agent in a container instead of giving it access to the host filesystem. The published agent image runs as a nonroot user. Create the tunnel with Target: /site, then use this Compose service from the directory containing your dist folder:

services:
  kepeink-agent:
    image: registry.kepeink.hu/agent:2
    restart: unless-stopped
    environment:
      KEPEINK_AGENT_TOKEN: ${KEPEINK_AGENT_TOKEN}
    volumes:
      - ./dist:/site:ro
      - kepeink-agent-data:/home/nonroot

volumes:
  kepeink-agent-data:

Put KEPEINK_AGENT_TOKEN=kpt_xxxxxxxx in a private .env file and run docker compose up -d kepeink-agent. The :ro mount lets the agent read the published files but not change them; keep secrets outside dist. No container port needs to be published. The data volume holds the agent's own state and must remain writable. Use a dedicated host directory that contains only the files you intend to publish.

The agent needs outbound access to Kepeink's router endpoint (agents.kepeink.hu) and release CDN (cdn.kepeink.hu) for discovery and updates, plus DNS resolution. If the system resolver fails, it can try public DNS and DNS-over-HTTPS fallbacks; a restrictive firewall may block those fallbacks when local DNS works. Container network isolation or an egress firewall can further limit where it can connect. See Run the agent with Docker for the general container setup.

3. Check the URL

Open the assigned HTTPS URL shown for the tunnel. Change a file and refresh; the next request serves the new version. If you already have a program serving HTTP, use a proxy tunnel instead.