Early access · hosted service
Houseguest™ lets a named person use an app on your private network on their own time: a prospect's evaluation, a client's review, a vendor's check. Access is time-limited and email-verified. No VPN, nothing to install, and nothing reachable while nothing is shared.
Houseguest™
Sign in to the preview of app.lab.example.com
Enter your work email. If it is on the list, a 6-digit code arrives in a moment.
The problem
A prospect evaluating your product, a client reviewing work in progress, a vendor checking a fix: each needs to click through an app that only runs inside your network. Today that means a VPN account for an outsider, a screen share, or a quick tunnel.
How it works
A small Docker container, or a systemd service without Docker, inside your network. It joins with a one-time token and connects out on port 443. Its allow-list, set on its own host, is the most it will ever forward.
In the console, pick the hostnames and how long the preview stays open. One sign-in covers every name, so apps that span several hostnames keep working.
They open the app's own address and confirm their email with a 6-digit code. Then they use the app with its own login, as they would on your network.
At the end, or when you press End, every new request is refused at once. Revoke one person at any moment, with the same effect. TCP and terminal connections already open run until they close. The request log shows who opened what, and when.
SSH and other TCP services can join a preview too: SSH in a browser terminal, or any TCP service end to end through the houseguest command line.
From your laptop: houseguest share 3000 --invite alice@acme.com shares one local port with the people you name, and ends on Ctrl-C. Houseguest for developers
Two kinds of preview
For a review or a demo with a few named people.
For a customer's team or a partner who needs to come back.
Addresses
Viewers use app.lab.example.com, the address the app already has.
Viewers use app.acme.houseguest.page. On the hosted service.
Security model
The agent opens one connection out on port 443 and proves itself with its own key. No inbound ports, no firewall changes.
The agent forwards only the hostnames in its own allow-list and refuses everything else, whatever the edge asks.
The edge asks the gate about each request. Expired, ended or revoked access stops at the next click.
Viewers confirm their address with a code that works for 10 minutes and allows 5 tries.
Houseguest sits in front of your app. People still sign in to the app itself, and its cookies never mix with ours.
The request log keeps the time, the person, the method, hostname and path, the result, and the browser, device type and country. The edge's web-server log adds the client IP and request headers such as the user agent. Never query strings, never request or response bodies.
Where it runs
Houseguest runs the edge, the console and the email. The agent runs next to the app, as a Docker container or a systemd service, and only dials out, on port 443.
| Plan | For |
|---|---|
| Free | One developer: one open preview, and one terminal share at a time for up to 8 hours |
| Pro | Small teams, with several agents, more open previews, and SSH and other TCP services |
| Business | Teams of 5 or more, with SSO, more agents and open previews, and no limit on viewers per preview |
| Enterprise | Organizations that must run everything themselves: the self-hosted edition, custom terms and support |
Viewers are free on every plan. Early access includes single sign-on. Run it yourself? The self-hosted edition is available on the Enterprise plan: hello@houseguest.dev.
Compared with
| A good fit when | Where Houseguest differs | |
|---|---|---|
| Quick tunnels | One service, a short look. | The app keeps its own hostnames, several in one preview with one sign-in. People are added or revoked, and the end date changed, from the console while the preview is open, at the same address. The request log shows who opened what. |
| An access proxy in front of your DNS zone | Standing access, run by someone with admin rights on the zone and the identity setup. | No policy to write, and the person sharing needs no admin rights: they open a preview within the hostnames the agent's host allows, and every preview has an end date. The app's DNS can be anywhere, and only the agent runs on your side. |
| A VPN account | The person is staff or a long-term contractor who needs much of the network, on a device you manage. | Only the hostnames in the preview, in a browser, with nothing to install. No network access, and nothing reachable while nothing is shared. |
| A screen share | You guide the session yourself and both of you are free at the same time. Nothing to set up. | The viewer uses the live app on their own time. The request log shows who opened what, and when. |
Questions
No. They open a link in any browser, enter a code from their inbox, and use the app.
No. It decides who may reach the app at all. Your app's own login, roles and data stay exactly as they are.
Outbound HTTPS from the host running the agent, and an app served over HTTPS. The agent checks the app's certificate against public roots or your internal CA. On the app's own hostnames, public DNS records point each shared name at the edge while inside your network the same names keep resolving to the app, as they do today. Houseguest addresses need no DNS changes at all.
That is what Houseguest is for. A preview covers several hostnames with one sign-in, and the app keeps its real names, so its cookies, redirects and cross-origin calls behave as they do on your network. On Houseguest addresses, apps that write links with their internal hostnames are better shared on those hostnames.
An invite works once and, by default, only with a code sent to the invited address. With standing access, the code goes only to addresses on the list.
Yes. A preview can include TCP services that the agent's host lists by exact name and port. SSH opens in a browser terminal, which the edge runs. The houseguest command line carries any TCP service through the edge without interpreting it. Encrypted protocols such as SSH or a database over TLS stay encrypted end to end; a protocol without encryption, such as plain HTTP or an unencrypted database connection, is readable at the edge.
Yes. Add or remove a hostname, add or remove people, extend the end date, or end it, all from the console and all effective at once.
The edge terminates TLS so it can check each request, so the hosted edge sees preview traffic while a preview is open. For each request the request log stores the time, the person, the method, hostname and path, the result, and the browser family and OS, device type and country. The edge's web-server log also records the client IP address, the request line and request headers such as the user agent. Neither keeps query strings or bodies. Organizations that must run everything themselves use the self-hosted edition, on the Enterprise plan.
No. Houseguest is a hosted service. The agent and the houseguest command line cost nothing on any plan, and early-access invitations include the download details. Organizations that must run everything themselves use the self-hosted edition, on the Enterprise plan.
Houseguest is a hosted service in private early access. Tell us what you want to share, with whom, and whether it runs under a domain you control.
hello@houseguest.dev