{"id":48456578,"url":"https://github.com/quantumpipes/tunnel","last_synced_at":"2026-05-24T05:02:48.318Z","repository":{"id":349211946,"uuid":"1201446597","full_name":"quantumpipes/tunnel","owner":"quantumpipes","description":"Encrypted remote access to any device, from anywhere. WireGuard VPN automation with post-quantum TLS, structured audit logging, and Capsule Protocol integration.","archived":false,"fork":false,"pushed_at":"2026-04-04T19:02:04.000Z","size":168,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2026-04-04T21:25:44.867Z","etag":null,"topics":["air-gapped","audit-logging","bash","capsule-protocol","compliance","devops","encryption","infrastructure","post-quantum","remote-access","security","self-hosted","vpn","wireguard","wireguard-vpn"],"latest_commit_sha":null,"homepage":"https://quantumpipes.com","language":"Shell","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/quantumpipes.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-04T17:31:54.000Z","updated_at":"2026-04-04T19:03:05.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/quantumpipes/tunnel","commit_stats":null,"previous_names":["quantumpipes/tunnel"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/quantumpipes/tunnel","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quantumpipes%2Ftunnel","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quantumpipes%2Ftunnel/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quantumpipes%2Ftunnel/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quantumpipes%2Ftunnel/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/quantumpipes","download_url":"https://codeload.github.com/quantumpipes/tunnel/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/quantumpipes%2Ftunnel/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":31492756,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-04-06T17:22:55.647Z","status":"ssl_error","status_checked_at":"2026-04-06T17:22:54.741Z","response_time":112,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["air-gapped","audit-logging","bash","capsule-protocol","compliance","devops","encryption","infrastructure","post-quantum","remote-access","security","self-hosted","vpn","wireguard","wireguard-vpn"],"created_at":"2026-04-06T23:06:55.505Z","updated_at":"2026-05-24T05:02:48.311Z","avatar_url":"https://github.com/quantumpipes.png","language":"Shell","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n# QP Tunnel\n\n**Encrypted remote access to any device, from anywhere.**\n\nAutomate WireGuard VPN setup, peer management, and service exposure with post-quantum TLS. Nine commands. Structured audit logging. Double encryption. Zero cloud dependency.\n\n[![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)\n[![Tests](https://img.shields.io/badge/Tests-370%2B-brightgreen.svg)](./tests/)\n[![Conformance](https://img.shields.io/badge/Conformance-15_vectors-ff69b4.svg)](./conformance/)\n[![Crypto](https://img.shields.io/badge/Crypto-WireGuard_%2B_PQ_TLS-purple.svg)](#security)\n[![Capsule](https://img.shields.io/badge/Audit-Capsule_Protocol-orange.svg)](https://github.com/quantumpipes/capsule)\n[![AI Agents](https://img.shields.io/badge/AI%20Agents-AGENTS.md-blueviolet.svg)](./AGENTS.md)\n\n\u003c/div\u003e\n\n\u003e **AI coding agents:** start with [AGENTS.md](./AGENTS.md). It contains the 9-command CLI surface, shell style rules (`set -euo pipefail`, quoted expansions, no `eval`), the two-layer crypto model, and the immediate-revocation / archival-permanent audit invariants.\n\n---\n\n## The Problem\n\nYou have a device behind a firewall. You need to reach it from anywhere, securely, without exposing it to the internet. Traditional options all have tradeoffs: port forwarding is fragile and insecure, SSH tunnels break under reconnection, commercial VPNs require cloud accounts and ongoing subscriptions, and manual WireGuard setup is error-prone at scale.\n\nQP Tunnel solves this with automation, audit logging, and defense-in-depth encryption.\n\n```\nYou (laptop)            Relay (any server)          Your device\n  ┌────────┐            ┌──────────────┐            ┌──────────────┐\n  │ alice  │──WireGuard─│   10.8.0.1   │──WireGuard─│   10.8.0.2   │\n  │ .0.10  │            │    relay     │            │  your server │\n  └────────┘            └──────────────┘            └──────────────┘\n  ┌────────┐                   │\n  │ bob    │───────────────────┘\n  │ .0.11  │   Split-tunnel: only 10.8.0.0/24\n  └────────┘   routes through the VPN\n```\n\n---\n\n## Why QP Tunnel\n\n**Works with any server.** DigitalOcean, AWS, Hetzner, Linode, Oracle Cloud (free tier), a Raspberry Pi, or your old laptop. If it runs Linux and WireGuard, it works.\n\n**Nine commands.** Setup, join, add peer, remove peer, status, rotate keys, open, close, list. That is the entire interface.\n\n**Double encryption.** WireGuard provides the outer tunnel (Curve25519/ChaCha20-Poly1305). Caddy provides an inner PQ TLS 1.3 layer (ML-KEM-768 hybrid key exchange) for exposed services. Both must fail for data exposure.\n\n**Cryptographic audit trail.** Every operation logged as structured JSON. Optional [Capsule Protocol](https://github.com/quantumpipes/capsule) integration seals each entry with SHA3-256 + Ed25519 for tamper evidence.\n\n**Instant revocation.** Remove a peer and access drops immediately. No grace period. No session expiry. Revoked configs archived for compliance.\n\n**Air-gap compatible.** No internet required after initial setup. No phone-home. No telemetry. No vendor lock-in.\n\n**White-label ready.** Set `TUNNEL_APP_NAME=yourproject` and every path, tag, and certificate adapts.\n\n---\n\n## Explore the fit with your AI coding agent\n\nPaste this prompt into Claude Code, Cursor, Codex, or any other agent:\n\n```text\nRead the QP Tunnel README and AGENTS.md at https://github.com/quantumpipes/tunnel.\nThen survey my infrastructure for remote-access surfaces: port forwards, bastion hosts,\nad-hoc SSH tunnels, commercial VPNs, and exposed service endpoints. For each, evaluate\nwhether a WireGuard outer layer plus post-quantum TLS inner layer would improve\nconfidentiality, auditability, or operational simplicity. Recommend the single highest-\nleverage surface to migrate first, with concrete ports, hostnames, and cut-over steps.\n```\n\n---\n\n## Quick Start\n\n### Option 1: Use any existing server (SSH)\n\n```bash\n# Configure your remote server as the relay\n./tunnel-setup-relay.sh --provider=ssh --host=203.0.113.10\n\n# On the target device: join the relay\n./tunnel-join.sh 203.0.113.10:51820 \u003crelay-public-key\u003e\n\n# Add yourself as a peer\n./tunnel-add-peer.sh alice\n# Scan the QR code or paste the config into your WireGuard app. Done.\n```\n\n### Option 2: This machine IS the relay\n\n```bash\n./tunnel-setup-relay.sh --provider=local\n```\n\n### Option 3: Provision a DigitalOcean Droplet\n\n```bash\nexport DO_API_TOKEN=dop_v1_...\n./tunnel-setup-relay.sh --provider=digitalocean\n```\n\n### Option 4: Generate a setup script\n\n```bash\n./tunnel-setup-relay.sh --generate-script \u003e setup-relay.sh\nssh root@your-server \u003c setup-relay.sh\n```\n\n### Option 5: Use Make targets\n\n```bash\ncp .env.tunnel.example .env.tunnel\nmake tunnel-setup-local      # Or: tunnel-setup-ssh, tunnel-setup-do\nmake tunnel-add-peer NAME=alice\nmake tunnel-status\n```\n\n---\n\n## Commands\n\n| Command | Description |\n|---------|-------------|\n| `tunnel-setup-relay.sh` | Configure a WireGuard relay (multi-provider) |\n| `tunnel-join.sh \u003cendpoint\u003e \u003ckey\u003e` | Join an existing relay from the target machine |\n| `tunnel-add-peer.sh \u003cname\u003e` | Add a peer: generates config + QR code |\n| `tunnel-remove-peer.sh \u003cname\u003e` | Revoke a peer immediately, archive config |\n| `tunnel-status.sh` | Show all peers with live handshake data |\n| `tunnel-rotate-keys.sh` | Rotate relay keys (dry-run by default, `CONFIRM=1` to execute) |\n| `tunnel-open.sh --name \u003cn\u003e --to \u003chost:port\u003e` | Expose a local service with PQ TLS over the tunnel |\n| `tunnel-close.sh --name \u003cn\u003e` | Stop exposing a service |\n| `tunnel-list.sh` | List all open services |\n\n### Exposing Services\n\nExpose any local application over the tunnel with post-quantum TLS:\n\n```bash\n# Expose Grafana with PQ TLS\n./tunnel-open.sh --name grafana --to localhost:3000\n\n# Expose Jenkins on a specific port\n./tunnel-open.sh --name jenkins --to localhost:8080 --port 8444\n\n# List open services\n./tunnel-list.sh\n\n# Close a service\n./tunnel-close.sh --name grafana\n```\n\n**How it works:**\n1. Generates an internal CA (Ed25519) and per-service TLS certificates\n2. Starts a Caddy reverse proxy with TLS 1.3 + ML-KEM-768 key exchange\n3. Binds the port to the tunnel interface only (unreachable from LAN)\n4. Installs firewall rules allowing only tunnel subnet traffic\n5. Registers the service and creates a Capsule audit record\n\nMobile devices: install the generated `ca.mobileconfig` on iOS to trust the internal CA. macOS and Linux trust store commands shown in the command output.\n\n---\n\n## Architecture\n\n```\n                      ┌─────────────────────────────────┐\n                      │        Relay Server             │\n                      │   (any Linux machine/VPS)       │\n                      │                                 │\n                      │   WireGuard: 10.8.0.1           │\n                      │   Port: 51820/udp               │\n                      │   NAT + IP forwarding           │\n                      │   Holds no data. Forwards only. │\n                      └──────────┬──────────┬───────────┘\n                                 │          │\n              ┌──────────────────┘          └──────────────────┐\n              │                                                │\n      ┌───────┴──────────┐                        ┌────────────┴─────────┐\n      │  Target Device   │                        │    Remote Peers      │\n      │  (your server)   │                        │                      │\n      │                  │                        │    alice:  10.8.0.10 │\n      │  10.8.0.2        │                        │    bob:    10.8.0.11 │\n      │  Persistent peer │                        │    carol:  10.8.0.12 │\n      │  Auto-reconnect  │                        │    ...up to .0.254   │\n      └──────────────────┘                        └──────────────────────┘\n```\n\n**The relay** is a rendezvous point. It forwards encrypted WireGuard packets between peers. It holds no data and runs no application logic. If compromised, attackers see only encrypted traffic they cannot decrypt.\n\n**The target device** connects to the relay as a persistent peer and reconnects automatically on reboot via systemd.\n\n**Remote peers** connect through WireGuard apps on any platform: macOS, Windows, Linux, iOS, Android. Each peer gets a unique keypair, a unique preshared key, and a unique IP address.\n\n**Split-tunnel** routes only `10.8.0.0/24` through the VPN. Everything else takes the normal internet path.\n\n---\n\n## Double Encryption\n\n```\n┌──────────────────────────────────────────────────────────────────────┐\n│                        OUTER LAYER: WireGuard                        │\n│                                                                      │\n│     Key exchange: Curve25519 (X25519)                                │\n│     Encryption:   ChaCha20-Poly1305                                  │\n│     Hashing:      BLAKE2s                                            │\n│                                                                      │\n│  ┌──────────────────────────────────────────────────────────────┐    │\n│  │                   INNER LAYER: PQ TLS 1.3                    │    │\n│  │                   (tunnel-open services only)                │    │\n│  │                                                              │    │\n│  │  Key exchange: X25519MLKEM768 (hybrid classical + PQ)        │    │\n│  │  Encryption:   AES-256-GCM                                   │    │\n│  │  Certificates: Ed25519 (internal CA)                         │    │\n│  │                                                              │    │\n│  │              ┌────────────────────────┐                      │    │\n│  │              │   Your application     │                      │    │\n│  │              │   (plaintext HTTP)     │                      │    │\n│  │              └────────────────────────┘                      │    │\n│  └──────────────────────────────────────────────────────────────┘    │\n└──────────────────────────────────────────────────────────────────────┘\n```\n\nIf Curve25519 is broken by a quantum computer, the inner PQ TLS layer still protects session data. If ML-KEM-768 has an implementation flaw, WireGuard's outer layer still protects. Both must fail simultaneously for data exposure.\n\nSee [CRYPTO-NOTICE.md](docs/CRYPTO-NOTICE.md) for the full cryptographic analysis.\n\n---\n\n## Audit System\n\nEvery operation writes a structured JSON entry to `audit.log`:\n\n```json\n{\n  \"timestamp\": \"2026-03-24T15:30:00Z\",\n  \"action\": \"peer_add\",\n  \"status\": \"success\",\n  \"message\": \"Added peer alice (10.8.0.10)\",\n  \"user\": \"operator\",\n  \"details\": {\"name\": \"alice\", \"tunnel_ip\": \"10.8.0.10\"}\n}\n```\n\nLogged actions: `setup_relay`, `tunnel_join`, `peer_add`, `peer_remove`, `key_rotate`, `service_open`, `service_close`, and all error traps.\n\n### Capsule Protocol Integration\n\nWhen [qp-capsule](https://github.com/quantumpipes/capsule) is installed, audit events are sealed as tamper-evident Capsules using SHA3-256 + Ed25519 signatures. This provides cryptographic proof that records have not been modified after creation.\n\n```bash\npip install qp-capsule           # Or: auto-installs on first use\nqp-capsule verify --db capsules.db   # Verify chain integrity\n```\n\nThe JSON audit log is the fast local index. Capsules are the cryptographic source of truth. Golden test vectors for the audit format are in [`conformance/`](./conformance/).\n\n---\n\n## Security\n\n| Layer | Mechanism |\n|-------|-----------|\n| **Transport (outer)** | WireGuard: Curve25519 + ChaCha20-Poly1305 + BLAKE2s |\n| **Transport (inner)** | PQ TLS 1.3: ML-KEM-768 + AES-256-GCM (tunnel-open) |\n| **Identity** | Unique keypair + preshared key per peer |\n| **File protection** | umask 077 on all keys (owner-only, mode 600) |\n| **Input validation** | Strict `[a-zA-Z0-9_-]` regex (prevents injection) |\n| **No eval** | Zero use of `eval` in the entire codebase |\n| **Token masking** | API tokens masked in all logs (last 4 chars only) |\n| **Audit trail** | Every operation logged with timestamp, user, and result |\n| **Tamper evidence** | Optional Capsule Protocol sealing (SHA3-256 + Ed25519) |\n| **Revocation** | Immediate removal from live WireGuard interface |\n| **Archival** | Revoked configs archived, never deleted (compliance) |\n| **Key rotation** | Built-in with dry-run safety and automatic backup |\n\nSee [Security Evaluation](./docs/security.md) for the full CISO-targeted assessment including STRIDE threat model.\n\n---\n\n## Compliance\n\nTunnel maps to 5 regulatory frameworks. Each mapping documents which controls the toolkit satisfies and which require complementary application-level controls.\n\n| Framework | Controls | Focus |\n|-----------|----------|-------|\n| [HIPAA](./docs/compliance/hipaa.md) | 164.312(e)(1), 164.308(a)(5) | Transmission security, access control, audit |\n| [CMMC 2.0](./docs/compliance/cmmc.md) | AC.L2-3.1.12/13/14, AU.L2-3.3.x | Remote access monitoring, encrypted sessions |\n| [FedRAMP](./docs/compliance/fedramp.md) | AC-17, SC-8, AU-2/3 | Remote access, transmission confidentiality |\n| [SOC 2](./docs/compliance/soc2.md) | CC6.1, CC6.7, CC7.x | Logical access, encryption, incident response |\n| [ISO 27001](./docs/compliance/iso27001.md) | A.5.15, A.8.20, A.8.24, A.8.26 | Access control, network security, crypto |\n\nFor FIPS-mandatory environments: WireGuard uses ChaCha20-Poly1305, which is not FIPS 140-2/140-3 validated. Substitute IPsec with FIPS-validated modules for those deployments. See the [compliance overview](./docs/compliance/).\n\n---\n\n## Configuration\n\nCopy `.env.tunnel.example` to `.env.tunnel` and customize:\n\n| Variable | Default | Description |\n|----------|---------|-------------|\n| `TUNNEL_APP_NAME` | `qp-tunnel` | Config directory, server tags |\n| `TUNNEL_SUBNET` | `10.8.0.0/24` | VPN subnet |\n| `TUNNEL_RELAY_IP` | `10.8.0.1` | Relay address within VPN |\n| `TUNNEL_SERVER_IP` | `10.8.0.2` | Target device address within VPN |\n| `TUNNEL_PORT` | `51820` | WireGuard listen port |\n| `TUNNEL_DNS_SERVER` | `10.8.0.2` | DNS server for peers |\n| `TUNNEL_ALLOWED_IPS` | `10.8.0.0/24` | IPs routed through tunnel |\n| `TUNNEL_INTERFACE` | `wg0` | WireGuard interface name |\n| `TUNNEL_CONFIG_DIR` | `~/.config/qp-tunnel` | State directory |\n| `DO_API_TOKEN` | (none) | DigitalOcean API token |\n| `RELAY_HOST` | (none) | Server IP for SSH provider |\n\nAll values are overridable via environment variables or `.env.tunnel`.\n\n### Relay Setup Providers\n\n| Provider | Flag | Requires | What it does |\n|----------|------|----------|--------------|\n| **SSH** | `--provider=ssh --host=IP` | SSH access | Configures an existing server remotely |\n| **Local** | `--provider=local` | Root on relay | Configures this machine as the relay |\n| **DigitalOcean** | `--provider=digitalocean` | `DO_API_TOKEN` | Provisions a new Droplet |\n| **Script** | `--generate-script` | Nothing | Outputs setup script to stdout |\n\nAuto-detection: if `DO_API_TOKEN` is set, defaults to DigitalOcean. If `RELAY_HOST` is set, defaults to SSH.\n\n---\n\n## Testing\n\n370+ tests across three tiers using [bats-core](https://github.com/bats-core/bats-core):\n\n```bash\nmake test              # All tests (unit + integration)\nmake test-unit         # Lib functions in isolation\nmake test-integration  # Full peer lifecycle workflows\nmake test-smoke        # File existence and structure\n```\n\nTests cover: input validation, key generation, registry CRUD, audit logging, Capsule sealing, certificate generation, PQ TLS config, firewall rules, service lifecycle, file permissions (600/700), peer lifecycle, key rotation, security hardening, edge cases, and error paths.\n\n---\n\n## Dependencies\n\n**Required:**\n\n| Dependency | Purpose |\n|------------|---------|\n| `bash` 4.0+ | Shell runtime |\n| `jq` | JSON processing for peer registry |\n| `wg`, `wg-quick` | WireGuard tools |\n\n**Optional:**\n\n| Dependency | Purpose |\n|------------|---------|\n| `caddy` (Go 1.24+) | PQ TLS reverse proxy for tunnel-open |\n| `openssl` | Certificate generation for tunnel-open |\n| `qrencode` | QR codes for mobile WireGuard apps |\n| `qp-capsule` | Tamper-evident audit sealing (auto-installs via pip) |\n| `doctl` | DigitalOcean CLI (curl fallback exists) |\n\n---\n\n## Documentation\n\n| Document | Audience |\n|----------|----------|\n| [Architecture](./docs/architecture.md) | Developers, Auditors |\n| [Security Evaluation](./docs/security.md) | CISOs, Security Teams |\n| [Why Tunnel](./docs/why-tunnel.md) | Decision-Makers, Architects |\n| [Compliance Mappings](./docs/compliance/) | Regulators, GRC |\n| [Cryptographic Notice](./docs/CRYPTO-NOTICE.md) | Security Engineers |\n| [Narrative Guide](./docs/GUIDE.md) | New Users |\n\n### Examples\n\n| Guide | Use Case |\n|-------|----------|\n| [DigitalOcean Quickstart](./examples/digitalocean-quickstart.md) | Cloud relay with 3 peers and exposed service |\n| [Home Lab](./examples/home-lab.md) | Raspberry Pi relay with Home Assistant |\n| [Healthcare Clinic](./examples/healthcare-clinic.md) | HIPAA-compliant remote EHR access |\n\n---\n\n## Project Structure\n\n```\n.\n├── tunnel-*.sh                  # 9 commands (setup, join, add, remove, status, rotate, open, close, list)\n├── tunnel-preflight.sh          # Pre-flight setup (sourced by all scripts)\n├── lib/\n│   ├── common.sh                # Logging, validation, config defaults\n│   ├── registry.sh              # Peer registry CRUD (JSON/jq)\n│   ├── audit.sh                 # Structured audit logging + Capsule sealing\n│   ├── open.sh                  # Service exposure: CA, certs, Caddy, firewall\n│   └── wireguard.sh             # WireGuard CLI wrappers\n├── templates/\n│   ├── client.conf.tpl          # Client config template\n│   └── Caddyfile.open.tpl       # PQ TLS Caddy template\n├── conformance/                 # Audit log golden test vectors (15 fixtures)\n├── completions/                 # Bash and Zsh tab-completion scripts\n├── tests/                       # 370+ tests (unit, integration, smoke)\n├── docs/                        # Architecture, security, compliance, guides\n├── examples/                    # Deployment walkthroughs\n├── .env.tunnel.example          # Configuration template\n├── Makefile                     # All operations as Make targets\n└── VERSION                      # 0.1.0\n```\n\n---\n\n## Contributing\n\nSee [CONTRIBUTING.md](./CONTRIBUTING.md). Issues and pull requests welcome. New relay providers can be proposed via [provider request](https://github.com/quantumpipes/tunnel/issues/new?template=provider-request.md).\n\n## License and Patents\n\n[Apache License 2.0](./LICENSE) with [additional patent grant](./PATENTS.md). You can use all patented innovations freely for any purpose, including commercial use.\n\n---\n\n\u003cdiv align=\"center\"\u003e\n\n**Encrypted remote access. Zero cloud dependency. Full audit trail.**\n\n[Documentation](./docs/) · [Examples](./examples/) · [Conformance](./conformance/) · [Security Policy](./SECURITY.md) · [Patent Grant](./PATENTS.md)\n\nCopyright 2026 [Quantum Pipes Technologies, LLC](https://quantumpipes.com)\n\n\u003c/div\u003e\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquantumpipes%2Ftunnel","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fquantumpipes%2Ftunnel","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fquantumpipes%2Ftunnel/lists"}