Skip to content

Self-hosted IPTV platform · v1.1.0

Run your IPTV stack like infrastructure.

tunlx is a Go-based proxy and tunneling service for Xtream-compatible upstreams. Publish stable endpoints, route egress through WireGuard or Tailscale, build composite catalogs across providers, and run the whole thing from one operations dashboard.

Get started View on GitHub Feature tour

Go 1.26 · single binary ghcr.io/eyupio/tunlx · multi-arch WireGuard · Tailscale · uTLS Xtream Codes API

Everything in one operator console

The tunlx dashboard

The tunlx dashboard in dark mode

See every screen in the dashboard tour

What tunlx gives you

Standard proxies Reverse-proxy any Xtream upstream with per-proxy routing, MediaFlow, EPG automation, and stable public URLs. Manage proxies

Composite catalogs Merge categories from multiple providers behind a single Xtream endpoint clients can subscribe to. Build a catalog

Xtream services Full Xtream Codes API backed by your own groups, channels, and users — with per-user expiry and connection limits. Run your own panel

WireGuard egress Bind individual proxies to a VPN tunnel. Use Mullvad provider mode for rotated configs, or bring your own. Configure VPN

Tailnet access Run dashboard and proxies on your Tailnet only, or use a Tailscale exit node as your outbound path. Lock it down

Inbound + outbound modes Choose how the platform listens (public, Tailnet, both) and how it dials out (public, VPN, exit-node). Pick a topology

Stream health tests Asynchronously probe HLS, MPEG-TS, MP4 and Matroska streams. Auto-disable consistently failing channels. Run health checks

IPTV-org catalog Pull thousands of public channels from the iptv-org catalog and turn them into curated groups in one click. Import channels

MediaFlow integration Offload HLS and MPEG-TS handling to MediaFlow Proxy for smoother playback and better seeking. Smooth playback

Activity & telemetry Bandwidth per proxy, request-by-request user activity logs, and configurable Xtream API audit policies. See what's happening

Anti-block toolkit uTLS fingerprints, custom User-Agent, VLC-style header normalization, optional 302 redirect mode for hotlink upstreams. Bypass detection

Xtream API surface Drop-in compatible with Xtream Codes clients — playlists, categories, EPG, VOD info, series — all there. API reference

How requests flow

flowchart LR
    classDef user  fill:#0ea5e9,stroke:#0369a1,color:#fff
    classDef tunlx fill:#6366f1,stroke:#4338ca,color:#fff
    classDef mod   fill:#1e293b,stroke:#334155,color:#e2e8f0
    classDef egress fill:#0f766e,stroke:#0d9488,color:#fff
    classDef src   fill:#a855f7,stroke:#7e22ce,color:#fff

    Client["IPTV / Xtream client"]:::user
    Browser["Operator browser"]:::user

    subgraph TUNLX["tunlx"]
      direction TB
      Dashboard["Dashboard<br/>+ Web Player"]:::tunlx
      Standard["Standard proxy"]:::tunlx
      Composite["Composite proxy"]:::tunlx
      Xtreme["Xtream service"]:::tunlx
      MediaFlow["MediaFlow bridge"]:::mod
      EPG["EPG scheduler"]:::mod
      Activity["Activity log"]:::mod
    end

    subgraph EGRESS["Egress modes"]
      direction TB
      System["System routing"]:::egress
      VPN["WireGuard / Mullvad"]:::egress
      Tsexit["Tailscale exit node"]:::egress
      Direct["Direct (sourceIP)"]:::egress
    end

    Upstreams["Upstream IPTV providers"]:::src
    IPTVOrg["iptv-org catalog"]:::src

    Browser --> Dashboard
    Client  --> Standard
    Client  --> Composite
    Client  --> Xtreme

    Standard  --> MediaFlow
    Composite --> Standard
    Xtreme    --> MediaFlow

    Standard  --> EGRESS
    Xtreme    --> EGRESS
    MediaFlow --> EGRESS

    EGRESS --> Upstreams
    Xtreme --> IPTVOrg

    Dashboard -. controls .-> Standard
    Dashboard -. controls .-> Composite
    Dashboard -. controls .-> Xtreme
    Dashboard -. reads .-> Activity

Pick your starting point

Install tunlx One-line installer for Linux hosts, or a Docker Compose stack you control. Install now

Getting started The end-to-end path: sign in, pick a blueprint, create a proxy, and connect a real client — with every screen shown. Walk it through

Dashboard tour Every dialog and screen in the dashboard, shown and explained. See every screen

Setup wizards Dashboard onboarding, plus a CLI wizard that builds an Xtream service from public catalogs. Try a wizard

Architecture How proxies, composites, services, egress, and the dashboard fit together. System view

Production-ready by design

  • Hardened HTTP layer — bcrypt admin auth, signed session cookies, CSP/HSTS headers, brute-force-resistant login rate limiting, and an opt-in enforceHttps redirect.
  • Per-proxy isolation — categories, credentials, EPG schedules, and verbose logging scope to a single proxy, so a misbehaving upstream doesn't take the platform down with it.
  • Observability built in — /metrics JSON, per-proxy bandwidth counters, EPG refresh status badges, and configurable Xtream API audit policies.
  • Honest about limits — every egress mode (system, vpn, tsexit, direct) is explicit per proxy, and the dashboard surfaces which one is active.

Source & community