Open Grafana or Home Assistant from anywhere — no port forwarding.

01  /  the problem

Why not just forward 8123 or 3000.

Forwarding a dashboard’s port to the internet puts a login screen — or worse, an open UI — in front of every scanner on the internet. The usual alternatives are their own project: a VPN means a client on every device you connect from and an account for everyone who needs in; a reverse proxy with a domain and access policies is a lot of moving parts for one internal page. An internal site skips all of it: the Connector only ever dials out, and the page is reachable to you and to named people, nobody else.

02  /  how it works

The machine dials out. You open a link.

• ▸Outbound only. The Connector holds a connection to termal.in and never listens — nothing to forward or scan, which is what lets it work behind NAT, CGNAT and a strict firewall.
• ▸A private address of its own. Each site gets a 10-character address like https://k7m4p9qrst.termal.ink/. termal.ink is a separate site from termal.in; its pages carry noindex and are kept out of search.
• ▸A real browser tab. The dashboard loads like any site — no client to install on the machine you’re sitting at.

03  /  set it up

A site in about a minute.

In the web cabinet open the Internal sites card (next to Backups) and click Add a site:

• ▸The Connector that can reach the site.
• ▸The address, as the Connector’s machine sees it — e.g. http://10.0.0.5:8080 or http://localhost:3000.
• ▸An optional name (up to 80 characters), whether the internal site uses https, and whether to send the link’s own address as the host name (for apps that are picky about the Host header).

Press Add and open and the dashboard opens in a new tab. A Connector’s context menu also has Open an internal site…. The desktop app lists your sites (Settings → Internal sites) and opens them already signed in; adding and sharing are done in the web cabinet, and mobile shows the list.

04  /  what works

Live dashboards, WebSockets and all.

Traffic streams through with no buffering, and WebSockets pass through — so the things that break on a naïve proxy just work:

• ▸Grafana live panels, Home Assistant, Portainer and Proxmox all behave as they do on the LAN.
• ▸http or https, any port. A self-signed or internal certificate on the dashboard is fine — tick “The internal site uses https”; that hop’s certificate isn’t checked, because it stays inside the Connector’s network.
• ▸Private addresses only. localhost, 10/8, 172.16/12, 192.168/16, link-local, Tailscale’s 100.64/10, IPv6 ULA — host names too, if they resolve to a private address. A public address is refused.

05  /  sharing

Let a colleague or family member in — for a day or a week.

Share a site with one email address at a time, for 24 hours or 7 days (sharing again extends it), up to 25 people on a link at once. Your own email has to be confirmed first.

• ▸The person gets an invitation email with a personal link and signs in with a 6-digit code sent to that address (good for 10 minutes, five tries). Anyone else who opens the site’s address sees only “This link doesn’t work” — nothing shows that a site is there.
• ▸No Termalin account needed — the code is all they use.
• ▸They see only that one dashboard, for as long as the share lasts; when it expires, their session ends.

06  /  the security model

Who can get in, and how you take it back.

• ▸No public mode. You open your own site with a one-time link (good for 120 seconds) that signs you in to it for 12 hours; everyone else is invited by email.
• ▸A locked-down cookie. The session cookie is host-only on the slug, __Host-, HttpOnly, Secure and SameSite=Lax, and it is stripped before anything reaches your dashboard.
• ▸Revoke instantly. Remove takes one person’s access away and stops their open pages at once; Turn off drops the link for everyone. If your plan falls back to Free, people you shared with see “access ended.”
• ▸An activity log records it: when the site was created, opened, shared, opened by someone you shared with, had access removed, or was turned off.

07  /  compared

Versus a tunnel service, Tailscale or a VPN.

The trade is honest: there is no permanent public link and a 5 GB-per-day soft cap per link, which is a feature for a private dashboard and a limit for a public one. For a homelab walk-through, see reaching Home Assistant or Grafana remotely.

08  /  plans and limits

Part of Pro and Team.

Internal sites need a Connector, so they come with the paid plans.

• ▸Free: not included. Trial: you can open sites, but not share them.
• ▸Pro and Team: no limit on the number of sites.
• ▸5 GB of traffic per link and 20 GB per account per UTC day — a soft brake, not a hard stop: a run in progress finishes and a short “come back tomorrow” page takes over. A single request is capped at 1 GB.
• ▸TLS in transit, not end-to-end. Traffic is carried over TLS and decrypted at the proxy to be relayed on.

See pricing →