CLI
env
Inspect the active profile and the environment variables that override it.
tunnelctl env prints the resolved profile — the set of endpoints the CLI talks to —
and shows which TUNNELCTL_* environment variable overrides each value.
tunnelctl envProfile values
The defaults are baked into the binary; any of them can be overridden with an environment variable:
| Env var | Default | Purpose |
|---|---|---|
TUNNELCTL_API_URL | https://tunnelctl-server.live.svc.piblade.net | Control-plane API endpoint |
TUNNELCTL_FRPS_ADDR | tun1.backend.tunnelctl.eu | FRP server (tunnel edge) hostname |
TUNNELCTL_FRPS_PORT | 443 | FRP server port |
TUNNELCTL_FRPS_PROTOCOL | wss | Transport (tcp, websocket, wss, …) |
TUNNELCTL_PUBLIC_DOMAIN | intunnel.eu | Public apex for tunnels — HTTP <slug>.intunnel.eu, L4 tcp.intunnel.eu:<port> |
TUNNELCTL_OIDC_ISSUER | https://id.nubeo.io/realms/NubeoSSO | OIDC issuer |
TUNNELCTL_OIDC_CLIENT | tunnelctl-cli | OAuth2 public client ID |
Targeting another environment
Override the profile to point the CLI at, say, a test environment:
export TUNNELCTL_API_URL=https://tunnelctl-server.test.svc.piblade.net
export TUNNELCTL_FRPS_ADDR=tun-test.example.com
tunnelctl login # fresh token from the test issuer
tunnelctl up http myapp 8080 # runs against the test control planeRe-authenticate after switching
Changing TUNNELCTL_OIDC_ISSUER or the API URL points the CLI at a different identity
provider — log in again so it mints a token for that environment.