pgrok: Share Local Services Through SSH Tunnels

Overview

pgrok lets a team expose services running on developers’ machines to the public internet through SSH remote port forwarding. Each user gets a stable subdomain, with access gated by an OIDC identity provider.

It is aimed at small teams that want a shared alternative to managed tunneling services and can operate the required server infrastructure. It is not presented as a production-grade service or a recommended option for individuals.

Key Features

• Tunnel HTTP traffic to a local service through an SSH connection.
• Forward raw TCP traffic and allocate a server-side port.
• Assign users stable subdomains, with optional custom prefixes for HTTP tunnels.
• Require authentication through an OIDC-compatible SSO provider.
• Route selected HTTP paths to alternate local services with dynamic forward rules.
• Connect using the pgrok client or a standard SSH client.
• Deploy the server as a binary, Docker container, or Docker Compose setup.

Use Cases

• Development teams can share a locally running web app with colleagues or stakeholders using a consistent URL.
• Teams can expose a local frontend while routing selected API or webhook paths to a separate local backend.
• Developers can make a local TCP service reachable for testing when they can open the needed server ports.
• Organizations with an OIDC provider can gate shared development tunnels through their existing sign-in system.

Getting Started

The server requires a public server, a domain with DNS records, an OIDC provider, and PostgreSQL. After deploying pgrokd and configuring the server, install the client and initialize a tunnel:

brew install pgrok
pgrok init --remote-addr example.com:2222 --forward-addr http://localhost:3000 --token YOUR_TOKEN
pgrok http

See the README for server setup, HTTPS configuration, Docker options, and TCP tunneling details.

Alternatives

• darkflare: DarkFlare tunnels TCP through CDN-routed HTTP(S) requests, rather than providing SSH-based HTTP and raw TCP access through stable subdomains.

Considerations

• You must provide and operate the public server, domain, DNS, OIDC integration, and PostgreSQL database.
• HTTP and TCP tunneling require appropriate inbound ports to be open on the server; raw TCP uses a configurable server-side port range described in the README.
• The project describes itself as a bare-bones solution for small teams and warns against relying on it in production systems with availability requirements.
• The MIT license permits use subject to its terms.