AI SRE is an assistant inside TunnelHQ. It looks into an outage when a monitor goes down, answers questions about your project’s tunnels, checks, servers, and incidents, and explains how to do things in TunnelHQ. It reads your project’s data and changes nothing until someone approves a change.
Go to AI SRE in the sidebar. The left column has New chat, Settings, a search box, and your chats, newest first. You can also start from an incident, or with Ask AI SRE on a server’s page.
Asking a question
Section titled “Asking a question”Click New chat and type a question, such as “What failed last night and why?” or “Which servers are slowest this week?”. Press Enter to send, or Shift and Enter for a new line. A question can be up to 2,000 characters, and you can ask a follow-up in the same chat.
An answer has a headline, a short explanation, the key facts, what it ruled out, and the steps or commands to fix the problem. It can include up to two tables or charts, built from the data it read rather than from its own words. Worked, under the answer, lists each step it took.
- Mark an answer Helpful or Not right. With Not right you can say what the real cause was, and AI SRE adds it to its notes for your servers.
- AI SRE answers in the language you ask in.
- It answers questions about your project and about using TunnelHQ. For anything else, it says so and suggests what it can help with.
Every chat is saved in the project, and everyone with access to the project can read it. Asking needs a role that can mute and pause monitors; other roles can read the answers.
Pasted links and configs
Section titled “Pasted links and configs”If you paste a share link, a WireGuard config, or a web address carrying a token, TunnelHQ cuts it out before saving the message. The chat shows dots in its place, and the AI model sees only what kind of link it is and its host. Keys and passwords in other configs are masked. If you ask, AI SRE can offer to add the pasted link as a tunnel or a subscription, as a card you approve.
When it looks into an outage by itself
Section titled “When it looks into an outage by itself”With Look into every outage by itself on, AI SRE starts when a monitor goes down. It skips warnings, degraded incidents, and maintenance. It opens a chat named after the monitor, works out why it went down, who is affected, and how to fix it, and writes the answer in English.
- The incident’s panel shows the answer’s headline, or “Looking into it…” while it works. Without one, the panel offers to ask AI SRE about the incident.
- The first answer also goes to the Telegram and Slack channels that alert for that monitor. Follow-up answers don’t.
- When several tunnels of one subscription go down on the same protocol, they share one alert message and one investigation. That answer shows on every tunnel’s incident and names any tunnel that doesn’t fit the shared cause.
It doesn’t look again at a monitor it looked into in the last 30 minutes, which covers a monitor that keeps going up and down. A project starts at most 3 investigations in 10 minutes.
What it reads
Section titled “What it reads”AI SRE reads only your project’s data, and only to read:
- Your tunnels, Uptime checks, groups, subscriptions, status pages, and alert channels, without a subscription’s address or a channel’s settings.
- Recent checks and check history, as far back as your plan keeps it, and incidents of the last 90 days.
- TunnelHQ’s own docs, when you ask how to do something.
- On servers that run the agent: readings and their history, users per day for the last 90 days by protocol and by country, and named checks such as a service’s state, its restarts, the firewall’s rules, and the ports the server listens on. Countries with fewer than 11 users are never kept.
- Whether a tunnel’s server still listens on the port the tunnel’s test uses. It answers listening or not listening, never the port, and it needs the agent on that server.
Two kinds of server reading are off until someone turns them on in Settings: the servers’ logs, and their VPN settings files.
Changes it suggests
Section titled “Changes it suggests”AI SRE can suggest a change as a card in its answer. Nothing changes until someone approves it: Approve, Approve for this chat, or Not now. Approve for this chat runs its later suggestions in that chat as you, without asking again.
An approved change runs as the person who clicked, so their role and your plan’s limits apply, just as if they made the change themselves. The card then says who approved it and when, and every approval is recorded in the audit log.
| It can suggest | Needs a role that can |
|---|---|
| Adding, changing, pausing, or running an Uptime check | Add or edit monitors |
| Renaming, pausing, resuming, or testing a tunnel | Edit monitors |
| Adding a pasted link as a tunnel, or a subscription link | Add monitors, or edit the project for a subscription |
| Syncing a subscription | Edit the project |
| Creating or renaming a group, or moving monitors into one | Add or edit monitors |
| Acknowledging an incident, or checking its monitor again | Edit monitors |
| Posting an incident or an update on a status page | Edit monitors |
| Planning a one-time maintenance window | Mute and pause monitors |
| Choosing a monitor’s alert channels, or sending a test alert | Edit monitors |
A status page post or maintenance note is written for your visitors, without server names, addresses, or internal causes. A tunnel test uses one of your plan’s on-demand tests. An answer can carry up to 3 cards.
AI SRE never offers to delete anything, change a tunnel’s address, protocol, passwords or keys, make or edit an alert channel, or touch API keys, billing, or people. TunnelHQ changes nothing on your servers: when one needs fixing, AI SRE gives you the commands to run there.
Settings
Section titled “Settings”Open Settings in the AI SRE column. Changes save at once, and need a role that can edit the project.
| Setting | What it does | Default |
|---|---|---|
| Look into every outage by itself | Starts an investigation when a monitor goes down. | Off |
| Which monitors | All monitors, Tunnels only, or Uptime checks only. | All monitors |
| Monthly limit | 25, 50, 100, 300, or 1,000 answers a month for the project. | 100 |
| Server logs | Lets it read what happened on servers that run the agent. | Off |
| Server settings files | Sign-in methods, user counts, ports, and whether a config parses. Never a password, key, or user name. | Off |
| Telegram and Slack, under Where it answers | Send an investigation’s first answer to the channels that alert for the monitor. | On |
Server settings files reads, for OpenConnect (ocserv), its sign-in methods, how many users its password file holds, and its ports and connection limits, and for Xray, whether its config parses, with each inbound’s protocol, port, transport, and security. It needs agent 1.9.0 or later.
Reading logs or settings files for a question also needs a role that can edit monitors. The agent removes addresses, user names, and lines about single connections before anything leaves the server.
Teach AI SRE
Section titled “Teach AI SRE”- Instructions: how your team works, in your own words, up to 2,000 characters. AI SRE follows them in every answer, unless they ask for something its rules don’t allow.
- Runbooks: your own step lists, up to 20 a project, beside the 14 built in. AI SRE follows one when its problem comes up.
- Notes: things it should know about your servers, such as “msk-2 reboots every night at 01:00 UTC”, up to 500 characters each. Marking an answer Not right adds one.
The monthly limit
Section titled “The monthly limit”Each answer counts: an investigation it starts, a question, and a follow-up. An answer that fails doesn’t count. The count starts on the 1st of each month (UTC), and Settings shows how many are used and when it resets.
At the limit, AI SRE starts no investigations, and asking says the project has used all its answers for the month. Someone who can edit the project can raise the limit. A project can have up to 3 answers running at once.
Privacy
Section titled “Privacy”To answer, AI SRE sends your question, the chat so far, your instructions, notes, and runbooks, and what it read to the AI provider TunnelHQ uses. That can include monitor names, hosts and ports, check messages, incident times, and server readings and check output.
It never sends:
- A tunnel’s credentials or connection settings, request headers and bodies, or heartbeat addresses.
- A subscription’s address or an alert channel’s settings.
- Pasted links and configs, or the port a tunnel’s test uses.
- Countries with fewer than 11 users, or another project’s data.