HushTunnel
A subscription control plane that also runs the network it bills for.
HushTunnel is a commercial privacy-network product: a Next.js control plane that sells and provisions access, a reseller hierarchy with its own ledger, and iOS and Android clients that do nothing but sign in and connect. Billing state and network state are the same state — an expired subscription revokes credentials on every edge node without anyone touching a panel.
Most billing dashboards stop at taking the money. HushTunnel's does not: the same transaction that records a payment also writes credentials onto every edge node the customer is entitled to use, and the same expiry that ends a subscription revokes them again. There is no nightly reconciliation job papering over the gap, because there is no gap.
The orchestrator
A central sync manager holds the list of active edge nodes and broadcasts subscription and credential changes to all of them. Each node reports traffic back; those deltas are aggregated into one global quota in Postgres rather than being counted per node, so a customer who moves between regions sees a single honest number.
Money
Resellers can create sub-resellers and allocate them an opening wallet balance. Every movement between any two accounts is an atomic transfer with mirrored ledger records on both sides — the balance column is never the source of truth, the ledger is. Stripe webhooks are deduplicated at two levels before they are allowed to touch a subscription or a deposit, because payment providers retry and a replayed event that credits an account twice is indistinguishable from fraud after the fact.
Prices across three stores
Apple, Google and Stripe disagree about what a price change means. Apple will auto-cancel subscribers who do not opt in to an increase above its threshold; Google's base plan identifiers are immutable once active; Stripe keeps existing subscribers on their original price object forever. The dashboard encodes those rules: it classifies a change as an increase or a decrease, requires explicit confirmation of the notice period and churn risk for increases, and commits Apple's territory price points in batches of forty because the API returns a 500 on larger ones.
The clients
The iOS and Android apps are deliberately thin. Login, subscription status, one connect button. The proven upstream VPN engine underneath is untouched — what changed is the front door, so a user never sees a server list or a configuration file.
Capabilities
Multi-node credential sync
One orchestrator broadcasts subscription and credential state to every active edge node and reconciles what comes back, so panels never drift apart.
Double-entry wallet
Atomic transfers between any two users or resellers write mirrored ledger records. Balances are derived, never authoritative.
Reseller hierarchy
Resellers create sub-resellers with an optional opening balance, and each tier sees only its own customers, orders and transactions.
Store price synchronisation
Compares the App Store, Google Play and RevenueCat catalogues, classifies each change as an increase or decrease, and enforces the notice rules before committing.
Idempotent payment webhooks
RevenueCat and Stripe events are deduplicated against both the subscription and deposit tables, so a provider retry can never double-credit an account.
Backups and vault
Scheduled backups of every managed panel, and encrypted storage for the credentials the orchestrator needs to reach them.
Screens
What it looks like in use.
Select any screen to view it full size. Use the arrow keys to move between screens and Escape to close.
Admin overview: node health, active subscriptions and revenue on one screen. Each subscription shows its aggregated quota, expiry, and credential state on every node it reaches. Edge nodes: sync status, last successful broadcast and backup state per panel. Price sync compares all three catalogues and refuses to commit an increase without explicit confirmation of the notice period. Reseller hierarchy with wallet balances derived from the double-entry ledger beneath them.
iOS client: sign in, see status, connect. No server list, no configuration files. Plans render live prices from App Store Connect rather than hard-coded strings. Android client, built on the upstream engine with only the front door replaced.