piko: Route Traffic to Services Behind Outbound Tunnels

Overview

Piko lets services that are not publicly routable receive HTTP(S) and TCP traffic. Instead of requiring those services to expose ports or be discoverable by a proxy, they establish outbound connections to Piko, which routes client traffic through those connections.

It is aimed at operators who need a self-hosted alternative to Ngrok and want to run the proxy as a cluster, particularly on Kubernetes. It is a fit when services sit inside customer networks, private clouds, or user devices and need controlled access from outside.

Key Features

• Routes HTTP(S) requests to upstreams identified by the host name or an x-piko-endpoint header.
• Supports TCP forwarding through Piko forward or the Go SDK.
• Balances requests among upstreams listening on the same endpoint.
• Supports clustered server nodes for fault tolerance, horizontal scaling, and zero-downtime deployments.
• Runs behind an HTTP load balancer or Kubernetes Gateway.
• Includes a Prometheus endpoint, access logging, and a status API for operations and troubleshooting.
• Provides an agent for HTTP and TCP listeners, plus a Go SDK for applications.

Use Cases

• Platform teams can expose services inside customer networks without asking customers to open inbound ports.
• BYOC providers can route traffic to workloads running in customer-controlled environments.
• Teams can provide access to user devices that can make outbound connections but are not publicly reachable.
• Kubernetes operators can host a clustered tunnel service behind an existing HTTP load balancer or Gateway.

Getting Started

See the Getting Started guide for setup instructions. The README shows an agent listener example: piko agent http my-endpoint 3000.

Alternatives

• wiredoor: Wiredoor routes HTTP, TCP, and UDP over WireGuard tunnels, while Piko focuses on clustered reverse-proxy ingress and Kubernetes deployment.
• pgrok: pgrok uses SSH port forwarding and OIDC for stable development tunnels, rather than Piko’s clustered, Kubernetes-friendly ingress.
• darkflare: DarkFlare carries TCP over HTTP(S) through a CDN for restrictive networks; Piko provides broader reverse-proxy ingress for production services.

Considerations

• Upstream services must be able to establish outbound connections to the Piko server.
• Raw TCP clients cannot select an endpoint by connecting directly to the server. Use Piko forward or the Go SDK to map a local connection to an endpoint.
• Production availability and scaling depend on deploying and operating a Piko server cluster; Kubernetes hosting guidance is available in the wiki.