Tunnel Basics
Local use is the default. Tunnel mode is opt-in.
Local server
Without tunnel flags, chan serve binds to 127.0.0.1 and gates requests with a per-launch bearer token.
Tunnel mode
With a tunnel token, the server dials the Chan tunnel service and publishes the workspace under workspace.chan.app. The local bearer-token gate is disabled in tunnel mode because the gateway in front of the public route becomes the trust boundary.
Public tunnel
Anonymous public access is not the default. Public tunnel behavior must be selected explicitly with the server flag that makes the tunnel public.