Shield Tunnel

The Tunnel is an outbound-only connection. A small helper runs on your side and dials out to Shield on port 443, wss://shield.aloviaai.net/tunnel. You never open a firewall port or expose a public address.

Back to Set up Shield, the full setup from the first step.

When to use it

Your server has no public address
Your platform blocks a proxy in front of it, Railway is the common case
A small helper on your side dials out to Shield. Nothing is opened inbound

Step by step

Turn the Tunnel on and copy your connection code

On the Connect with Shield Tunnel tab, press Turn on. Your connection code appears in step 1 of the card and stays there. Keep it private, and use Regenerate code if it ever leaks.

Choose where your server runs and run the matching option

These steps are for a Linux server.

Run this on your server

curl -fsSLo install.sh https://get.aloviaai.com && echo "d2d0b9d3e54f5e5dbb9465ea6c658aec206fd2024f5a7b16f34211e3cbf1f553  install.sh" | sha256sum -c && sudo SHIELD_TUNNEL_TOKEN=<your connection code> bash install.sh

It asks where your app listens, like http://localhost:3000, then keeps running in the background. The check value shown here is published on a different server than the script, so a tampered script fails to verify before it runs. If it says FAILED, do not run the script; email security@aloviaai.com.

Wait for it to connect

The dashboard flips from Waiting to Connected on its own, usually within a minute. Your site is live at that moment.

If it does not connect, check the helper's logs

invalid_token in the logs

The connection code is wrong or was regenerated. Get a fresh one from the dashboard and update it.

connection refused in the logs

SHIELD_ORIGIN_URL is not pointing at your running app. Set it to where your app listens.

Nothing in the logs

The helper is not running. Start it again.

After it is live

Shield now serves your visitors. You can lock your server so only Shield can reach it, the Security tab shows a copy-paste snippet, tune protection, or add another site anytime.

Stuck on something this page does not answer? Tell us, we read every note.