backends/tunnel: better interface + doc