Reach your brain from anywhere.
No tunnels. No ports. No domain.
A self-hosted Cloudflare edge — a Worker plus one Durable Object — that fronts a single NAVIG brain over one outbound WebSocket. Your brain dials out and stays connected; Lighthouse pushes Telegram, the deck, SSE and SMS down the pipe and reads the replies back.
One outbound pipe. Everything else is relayed.
Inbound work lands on a Worker in your account and is multiplexed down a single WebSocket your brain opened from home. The edge stays stateless and holds nothing sensitive.
Tenancy is keyed by sha256(api_key). The edge never holds your bot token, and outbound replies go direct from the brain.
Three moving parts. One outbound connection.
Exposing a home server usually means a tunnel daemon, a port-forward, or a static IP. Lighthouse needs none of that.
Deploy to your Cloudflare
navig lighthouse deploy uploads a prebuilt Worker + Durable Object to your own account and returns a stable *.workers.dev URL. No domain, no Node, no wrangler.
The brain dials out
navig gateway start opens one outbound WebSocket from your brain to the edge and keeps it warm. No inbound port is ever opened on your network.
The edge relays everything
Telegram webhooks, the deck UI/API, SSE and SMS land on the Worker and are multiplexed down that single uplink. Replies travel back the same pipe.
Built to hold nothing sensitive
The edge is stateless-by-design. Tenancy is keyed by sha256(api_key); outbound traffic stays direct from the brain; the only stateful binding is one Durable Object per brain.
Outbound-only uplink
The brain opens one outbound WebSocket and keeps it warm. No inbound ports, no port-forwarding, no tunnel daemon, no static IP.
Your account, your edge
Deploys to your own Cloudflare account. NAVIG runs nothing on your behalf — you own the Worker and the Durable Object outright.
Secret-free by design
The edge never holds your bot token or any NAVIG secret. Every route authenticates; tenancy is isolated per sha256(api_key).
Never drops a message
While the brain sleeps the Durable Object serves the last snapshot for deck reads and queues inbound Telegram/SMS for replay on reconnect — bounded and TTL’d. Nothing is lost.
Pure-Python deploy
A prebuilt Worker bundle is uploaded through the Cloudflare REST API. No Node and no wrangler at deploy time — just NAVIG.
Free-tier viable
DO-SQLite buffering keeps it running on the free Workers plan. Cloudflare Queues + DLQ are an optional paid hardening, never a requirement.
How it routes
Everything inbound lands on the Worker and is multiplexed down the single uplink. <hash> is sha256(api_key) — the opaque per-brain path the brain sets itself via setWebhook. The edge never holds the bot token.
GET /uplinkBearer <deck.api_key>Brain establishes its uplink WebSocketGET /api/eventsBearerDeck SSE stream (held open by the DO)ALL /api/*, /runtime/*, /mesh/*BearerDeck API → forwarded down the uplinkPOST /tg/<hash>Telegram secret headerBrain’s Telegram webhook handlerPOST /sms/<hash>Provider signatureBrain’s inbound-SMS handlerDeploy in one command
Authorize Cloudflare in your browser — there is no API token to create — and NAVIG uploads the edge and wires your Telegram webhook for you. Power users can pass a scoped token instead.
navig lighthouse loginnavig lighthouse deploy --token <cf_token>navig lighthouse urlnavig lighthouse statusManage it later with navig lighthouse status · url · redeploy · disable. The deck UI deploys separately via navig miniapp deploy, reusing the same Cloudflare credential.
Questions
Do I need a domain?
No. Every deploy gets a free https://navig-lighthouse.<sub>.workers.dev URL. Bring a custom domain later if you want — nothing requires it.
Does it cost anything?
No. The free Cloudflare Workers plan is enough — Durable-Object SQLite buffering keeps it viable. Cloudflare Queues + a dead-letter queue are an optional Workers-Paid hardening, not a requirement.
Can the edge read my messages or secrets?
No. The edge is secret-free by design. It never holds your bot token; tenancy is keyed by sha256(api_key), and outbound replies and SMS sends go direct from your brain. If the brain is offline it serves only the last cached snapshot plus a bounded, TTL’d replay queue.
How is this different from a tunnel?
A tunnel forwards inbound traffic to an open listener on your machine. Lighthouse never opens an inbound port — your brain dials out and the edge pushes work down that one connection. No tunnel daemon, no port-forward, no static IP.
Where does it run, and who owns it?
In your own Cloudflare account. You own the Worker and the Durable Object; NAVIG runs nothing on your behalf. It is open-source under Apache-2.0 — read every line on GitHub.
Light it up.
Open-source under Apache-2.0 and built to hold nothing sensitive — read every line, then deploy it to your own Cloudflare in one command.