- Category
- Platforms
- Status
- Live
- Platforms
- Web, iOS, Android, API
- Stack
- Next.js, PostgreSQL, Prisma, Swift, Kotlin, Stripe, RevenueCat, Docker
HushTunnel is a commercial privacy-network product: a Next.js control plane that sells and provisions access, a reseller hierarchy with its own ledger, and iOS and Android clients that do nothing but sign in and connect. Billing state and network state are the same state — an expired subscription revokes credentials on every edge node without anyone touching a panel.
Most billing dashboards stop at taking the money. HushTunnel's does not: the same transaction that records a payment also writes credentials onto every edge node the customer is entitled to use, and the same expiry that ends a subscription revokes them again. There is no nightly reconciliation job papering over the gap, because there is no gap.
The orchestrator
A central sync manager holds the list of active edge nodes and broadcasts subscription and credential changes to all of them. Each node reports traffic back; those deltas are aggregated into one global quota in Postgres rather than being counted per node, so a customer who moves between regions sees a single honest number.
Money
Resellers can create sub-resellers and allocate them an opening wallet balance. Every movement between any two accounts is an atomic transfer with mirrored ledger records on both sides — the balance column is never the source of truth, the ledger is. Stripe webhooks are deduplicated at two levels before they are allowed to touch a subscription or a deposit, because payment providers retry and a replayed event that credits an account twice is indistinguishable from fraud after the fact.
Prices across three stores
Apple, Google and Stripe disagree about what a price change means. Apple will auto-cancel subscribers who do not opt in to an increase above its threshold; Google's base plan identifiers are immutable once active; Stripe keeps existing subscribers on their original price object forever. The dashboard encodes those rules: it classifies a change as an increase or a decrease, requires explicit confirmation of the notice period and churn risk for increases, and commits Apple's territory price points in batches of forty because the API returns a 500 on larger ones.
The clients
The iOS and Android apps are deliberately thin. Login, subscription status, one connect button. The proven upstream VPN engine underneath is untouched — what changed is the front door, so a user never sees a server list or a configuration file.
- Multi-node credential sync
- One orchestrator broadcasts subscription and credential state to every active edge node and reconciles what comes back, so panels never drift apart.
- Double-entry wallet
- Atomic transfers between any two users or resellers write mirrored ledger records. Balances are derived, never authoritative.
- Reseller hierarchy
- Resellers create sub-resellers with an optional opening balance, and each tier sees only its own customers, orders and transactions.
- Store price synchronisation
- Compares the App Store, Google Play and RevenueCat catalogues, classifies each change as an increase or decrease, and enforces the notice rules before committing.
- Idempotent payment webhooks
- RevenueCat and Stripe events are deduplicated against both the subscription and deposit tables, so a provider retry can never double-credit an account.
- Backups and vault
- Scheduled backups of every managed panel, and encrypted storage for the credentials the orchestrator needs to reach them.
Captures of HushTunnel are pending. We would rather show you nothing than a drawing of a screen that was never photographed.