Public Sharing

How It Works

A self-hosted LiveFolio instance runs on localhost. To share folios publicly, you need a tunnel that proxies traffic from a public URL to your local server.

LiveFolio uses the untun package to create these tunnels:

Viewer's browser
    │
    │  https://random-name.trycloudflare.com/share/abc123
    ▼
Tunnel (encrypted)
    │
    ▼
Your machine (localhost:3000)
    │
    ▼
LiveFolio serves the folio

The air-gap firewall ensures only /share/* and public API endpoints are accessible externally.

Starting the Tunnel

Via MCP

{
  "method": "tools/call",
  "params": {
    "name": "toggle_sharing_tunnel",
    "arguments": { "action": "start" }
  }
}

Via API

curl -X POST http://localhost:3000/api/tunnel \
  -H "Content-Type: application/json" \
  -d '{"action": "start"}'

# Response
# {"success":true,"url":"https://random-name.trycloudflare.com"}

Via Dashboard

The dashboard header has a tunnel toggle (self-hosted mode).

Enabling a Folio for Public Access

After starting the tunnel, enable public access for individual folios:

curl -X POST http://localhost:3000/api/mcp \
  -H "Content-Type: application/json" \
  -d '{
    "jsonrpc":"2.0",
    "method":"tools/call",
    "params":{
      "name":"set_folio_public_access",
      "arguments":{"project_id":"my-folio","enabled":true}
    },
    "id":1
  }'

Checking Tunnel Status

curl http://localhost:3000/api/tunnel

# {"active":true,"url":"https://random-name.trycloudflare.com"}

To check a specific folio's access status via MCP:

{
  "name": "get_sharing_status",
  "arguments": { "project_id": "my-folio" }
}

Stopping the Tunnel

curl -X POST http://localhost:3000/api/tunnel \
  -H "Content-Type: application/json" \
  -d '{"action": "stop"}'

Existing share URLs stop working until the tunnel is restarted.

Custom Domain

Set a custom tunnel URL in settings.json:

{
  "customTunnelUrl": "https://folios.mycompany.com"
}

This requires your own tunnel configuration pointing to your LiveFolio instance.

Air-Gap Firewall

External tunnel access is restricted. Only these paths are publicly accessible:

Path	Public
/share/[id]	Yes
/api/raw/[id]/[[...path]]	Yes
/api/files/[id]/public	Yes
/api/files/[id]/comments	Yes
/api/files/[id]/reactions	Yes
/api/files/[id]/analytics	Yes
/dashboard	No
/studio/[id]	No
/api/files (admin)	No

This keeps administrative controls local-only.

Limitations

• Tunnel URLs change on server restart (unless using a custom domain)
• Internet connection is required for tunnel sharing
• One tunnel per instance
• Throughput limits apply (typical free tier: ~100 MB/h)