TinyChannels End

TinyChannels End is a secure endpoint client that connects to TinyChannels Edge servers through WebTransport-based tunneling with channel authorization managed by the TinyChannels Center Authorization Manager.

The End client operates as a background daemon and is managed through the TinyChannels End Utility, a graphical application available on macOS and Windows, or via CLI on Linux.

Network access to the Authorization Manager endpoint (HTTPS) and Edge servers (UDP/QUIC) is required.

1. Open the .pkg or .dmg installer.
2. Follow the on-screen instructions. Administrator privileges are required.
3. The application is installed to /Applications/TinyChannels End.app.
4. Configuration and data are stored in /Library/Application Support/TinyChannels End/.

1. Run the .msi installer.
2. Follow the installation wizard. Administrator privileges are required.
3. Binaries are installed to C:\Program Files\TinyChannels End\bin\.
4. Data is stored in C:\ProgramData\TinyChannels End\.

1. Install: sudo dpkg -i tinychannels-end_*.deb
2. All files are installed to /opt/tinychannels-end/.

1. Install: sudo rpm -i tinychannels-end-*.rpm
2. All files are installed to /opt/tinychannels-end/.

Before using TinyChannels End, you must register it with an Authorization Manager.

GUI (macOS / Windows)

1. Enter the End Name (defaults to your hostname).
2. Enter the Authorization Manager Endpoint URL (e.g. https://your-center.example.com). Do not include /api — it is added automatically.
3. Enter the Protection Code — a shared secret obtained from the Authorization Manager operator (Portal Edge/End page). The protection code may be rotated periodically.
4. Click Register.
5. If the server's TLS certificate is not trusted by the system, a certificate approval dialog will appear (see next section).
6. Upon successful registration, you will be prompted to start the daemon.

CLI (Linux)

Run the utility with the init subcommand:

sudo /opt/tinychannels-end/bin/tinychannels-end-utility init \
    --auth-manager-endpoint https://your-center.example.com \
    --end-name "Office PC"

You will be interactively prompted for the Protection Code — the input is hidden (like a password). Press Enter after typing.

When connecting to an Authorization Manager with an untrusted TLS certificate, a certificate details dialog is shown displaying:

• Issuer, Common Name, Subject Alternative Names (SAN)
• Valid From / Valid To dates
• Hash Algorithm

Click Accept to trust the certificate and proceed with registration, or Deny to abort.

The TinyChannels End daemon runs as a background service. Use the utility to start and stop it:

• Start (▶) — Starts the daemon. It will connect to the registered Edge server.
• Stop (■) — Stops the daemon and disconnects from the Edge.

macOS

The daemon runs as a LaunchDaemon (com.shimousa.tinychannels.end).

Linux

Managed via systemd: systemctl start tinychannels-end / systemctl stop tinychannels-end

Windows

Runs as a Windows Service named TinyChannelsEnd.

The utility shows real-time status information:

Status is polled automatically every 5 seconds.

The Advanced Configuration panel in the utility allows you to configure the target IP address ranges used by TinyChannels End.

Target Networks

Target networks define which IP address ranges are captured and tunnelled through TinyChannels channels. Traffic destined for these ranges is intercepted by the packet handler and forwarded to the remote End via the Edge.

• Enter each network in CIDR notation (e.g. 172.21.0.0/16, 172.16.0.0/12).
• The first network determines the pseudo base address used for mapping remote End UUIDs to local IP addresses, and the DNS server address (broadcast address − 1).
• Click Add Network to add additional ranges, or the trash icon to remove one.
• Click Save to write the configuration to tinychannels-end.yaml.
• After saving, restart the daemon for changes to take effect.

The main configuration file is tinychannels-end.yaml. Key settings:

Example:

Directory:
  HomeDirectory: /Library/Application Support/TinyChannels End
LogRotation:
  Generations: 4
TargetNetworks:
  - "172.21.0.0/16"

If the file is missing or contains no valid target networks, the default 172.21.0.0/16 is used.

tinychannels-end

tinychannels-end-utility

Use tinychannels-end-utility <command> --help to see all options for a subcommand.

macOS

Run the uninstall script: sudo "/Applications/TinyChannels End.app/Contents/MacOS/uninstall.sh"

Data remains at /Library/Application Support/TinyChannels End/ and can be manually removed.

Linux (Debian/Ubuntu)

sudo dpkg -r tinychannels-end

Linux (RHEL/CentOS)

sudo rpm -e tinychannels-end

Windows

Uninstall from Settings > Apps or Control Panel > Programs.