Concepts & Mental Model
If you are new to FRP, NAT, or reverse tunnels, start here. You do not need to understand FRP internals before using FRP Auto Deploy.The one-sentence model
Install one public entry server, let remote clients connect outbound to it, then reach each published TCP service through a persistent public port on that server.
Before vs after
The important difference is who starts the connection. The remote client starts the tunnel toward the server, so the client normally does not need its own public IP or inbound NAT rule.The five objects to remember
Labels, hostnames, notes, and tags help humans organize clients, but they are metadata. They do not replace CLIENT ID.
One client can publish many services
Each service has a stable Service ID and a persistent public-port reservation.Three different network paths
FRP Auto Deploy has three paths that beginners often mix together:- Enrollment / management establishes trust and manages client state.
- FRP control keeps the reverse tunnel available.
- Published service traffic is the actual SSH/HTTP/HTTPS/custom TCP connection.
What Zero-Touch actually does
Enrollment is similar to securely pairing a new client with the server. After successful enrollment, normal reboots and supported updates do not require re-enrollment.Public IP vs public hostname
What FRP Auto Deploy does not do
It intentionally leaves these responsibilities outside the product:- cloud security groups and external firewall policy
- NAT/DNAT rules
- DNS provider records
- operating-system users and SSH keys
- application authentication
- application TLS certificates
If you only want to get a first connection working, continue with the Quick Start. If you want implementation details, read Architecture.