Bring any server to Ploi,
even behind a firewall you can't change
One command opens a locked-down tunnel to our relay and gives your server its own public IPv6 address. Ploi connects to it like any other server. No inbound ports, no firewall rules, no VPN client.
curl -fsSL https://ploi.apptory.eu/connect | sudo bash
How it works
Outbound only. Reachable only by Ploi.
Your server dials out to the relay on port 443 — the one port firewalls almost always leave open. Nothing ever connects in.
Your server
Behind NAT or a firewall you don't control.
sshd :22Relay
Binds a public IPv6 derived from your key.
locked-downPloi
Connects to the IPv6 on port 22, manages as usual.
port 22Why it's nice
Simple by design
No firewall changes
The server only needs outbound 443. Nothing to open, nothing to forward — ideal for locked-down corporate or ISP networks.
Its own public IPv6
The address is derived from the server's SSH key — stable, unique, and assigned with zero coordination. No accounts, no database.
Locked-down relay
A tunnel can do exactly one thing: expose its own port 22 to Ploi's IPs. No shell, no proxying, no reaching other servers.
Runs as a service
Installed as a systemd unit that reconnects on drop and survives reboots. Set it once and forget it.
Security
Open to connect, useless to abuse
Anyone may open a tunnel — but a key can only ever bind the one address derived from it, and that address is reachable only from Ploi's IP ranges. The relay grants no shell, no port-proxying, and no path to any other server.
command=/bin/false
✓ no proxying · PermitOpen none
✓ address pinned per key
✓ inbound = Ploi IPs only
Add to Ploi
Three steps
Run the command on your server
As root. It generates a key, starts the tunnel, and prints your address.
Copy the IPv6 it prints
Something like 2a01:4f8:1c16:702c:… — this is your server's public address on the relay.
Add the server in Ploi
Paste the IPv6 as the server IP, port 22. Ploi provisions it like any other machine.