lablink_allocator_service.providers.connectivity.reverse_tunnel

lablink_allocator_service.providers.connectivity.reverse_tunnel

Reverse-tunnel connectivity: browser -> allocator nginx -> client KasmVNC, reached through a tunnel the client dials OUT to the allocator's own address and holds open. For clients that can neither accept inbound connections nor run Tailscale.

Either scheme works: the CLI derives the tunnel's ws:///wss:// URL from whichever --allocator-url it proved reachable at registration time (see register.py). A manual deployment pinned to ssl.provider: none and reached over plain HTTP is a supported configuration, not a degraded one.

Independent of manual.participant_exposure, which concerns where participants are rather than where clients are. With exposure none the allocator stays LAN-only and participants must be on that LAN — but sessions still reach the desktop, because this mode proxies them through the allocator's own nginx (see _resolve_tunnel_alias) rather than sending the browser to the client. That is exactly why lan_direct is the one mode the validator refuses to combine with an exposure mode.

The tunnel implementation is an internal detail; nothing in this module's public shape names it. See tunnel_manager.

Classes

ReverseTunnelClientConnectivity

Attributes

name = 'reverse_tunnel' class-attribute instance-attribute

requires_tailscale_check = False class-attribute instance-attribute

requires_tunnel_check = True class-attribute instance-attribute

Methods:

cleanup_client_identity(*, hostname)

Source code in packages/allocator/src/lablink_allocator_service/providers/connectivity/reverse_tunnel.py

def cleanup_client_identity(self, *, hostname: str) -> None:
    tunnel_manager.revoke_client(hostname)

make_join_material(*, allocator_url, client_image, register_token)

Source code in packages/allocator/src/lablink_allocator_service/providers/connectivity/reverse_tunnel.py

def make_join_material(
    self,
    *,
    allocator_url: str,
    client_image: str,
    register_token: str,
) -> ClientJoinMaterial:
    return ClientJoinMaterial(
        register_token=register_token,
        allocator_url=allocator_url,
        connectivity=self.name,
        client_image=client_image,
    )

prepare_browser_session(**kwargs)

Source code in packages/allocator/src/lablink_allocator_service/providers/connectivity/reverse_tunnel.py

def prepare_browser_session(self, **kwargs) -> BrowserSessionTarget:
    kwargs.setdefault("fallback_fn", _resolve_tunnel_alias)
    return prepare_browser_session(**kwargs)

Functions: