Telepy

Why it exists

The machines I needed to reach kept ending up somewhere unreachable: a server behind NAT, a Raspberry Pi at home, an office PC behind a firewall, a router that only lets HTTPS out.

Port forwarding needs a router you control, a VPN needs software on every laptop, and both need someone to maintain them. Every one of those devices could already reach the internet, judging by how often they download updates. So Telepy turns the connection around: the device dials out, and you work on it from the browser.

How it works

Your browser

HTTPS

Telepy server

Traefikfront door, HTTPS
Next.jsweb interface
Rust backendREST · WebSockets · SSH gateway · monitor · SQLite
guacdRDP / VNC engine
kasm-browserChromium for remote browsing

reverse SSH, dialed out by the device

Device

ssh -R

LAN hosts behind it

The device runs an ordinary ssh -R to the gateway built into Telepy. Nothing is opened on the server, and both ends check each other's host key.

What it does

Connect devices

One command on Linux, macOS and OpenWrt, followed live until Telepy can log in
A step-by-step wizard with ready-made scripts for Windows, Docker and appliances
SSH inside a WebSocket on the web port when only HTTPS gets out
Health, per-hop latency and search that understands status:down or label:env=prod

Work on a device

Web terminal with tabs, Nerd Fonts, a toolbox of saved commands and recordings
File manager with an editor that never saves half a file
RDP and VNC through the tunnel, or RustDesk in the tab
A real Chromium that goes online from the device, for admin pages that only open on that network

Teams and control

View, edit or admin sharing with expiry; removing someone ends their sessions at once
Command rules that block, hold for approval or remind, for people and MCP agents alike
Watch a live terminal, hand over the keyboard, or end a session
Tamper-evident audit logs, recordings and sign-in history

Automate

telepy CLI: ls, ssh, exec on twenty devices at once, cp
REST API with scoped personal tokens, device limits, expiry and a call log
MCP endpoint so Claude Code or Cursor can work on devices, every call logged

From Django to Rust

In October 2026 the Django backend was rewritten as one Rust process behind the same API. Measured side by side on the same machine and the same device, right after the switch:

Measure	Django	Rust	Change
Device connect → online on the dashboard	2.90 s	0.16 s	18.1×
Device SSH authentication	54 ms	12 ms	4.5×
Dashboard API, 50 concurrent	561 req/s	4,726 req/s	8.4×
Web terminal throughput	35.1 MB/s	96.9 MB/s	2.8×
Backend cold start	14.2 s	0.7 s	20.1×
Memory at idle	329 MiB	20 MiB	16.5×
Processes per connected device	2 sshd + sampler	0 (one Tokio task)	—

Full benchmark notes (opens in a new tab)

Stack

Rust
axum
russh
Tokio
SQLite
Next.js
TypeScript
Docker Compose
Traefik
Apache Guacamole
KasmVNC
RustDesk
MCP

Keyboard shortcuts

Why it exists

How it works