Reach a server-side service
3 minute read · SSH Terminal
A tunnel lets a local tool reach a service through an SSH server. Use it when the database should not be directly exposed to your computer’s network.
- Reach a private database through a saved host
- Manage explicit forwarding
- Discover project configuration without leaking it
- Verify the tunnel end to end
Reach a private database through a saved host
First verify that the SSH host can connect with the intended user. In the database connection, choose that saved host for the tunnel and specify the database address as reachable from the remote side. A database listening on the remote machine's loopback is different from a database on your laptop's loopback.
Connect, inspect the expected schema and read a small known row. If SSH succeeds but the database times out, check the tunnel destination and server-side reachability. If the database rejects authentication, check the database credentials separately from the SSH key.
Reusing a host avoids entering the same SSH identity in several places. It does not grant a new database privilege or make every port on that server appropriate to access.
Manage explicit forwarding
Use the port-forward controls to define the source/listening port and destination. Choose an unused local port and understand which interface is exposed. Start the forward, test the intended service and stop it when finished. If a port is occupied, identify the existing process or forward before replacing it.
A forward depends on the relevant connection and local desktop being available. It is not a permanently hosted proxy. Avoid leaving a local development service exposed more broadly than the task needs.
Discover project configuration without leaking it
Supported database discovery can read an app's configuration through SSH and turn it into a saved SQL connection. Confirm the project and environment before the read, and keep discovered passwords out of chat output. A Laravel Tinker operation can execute application code; it requires the same scrutiny as another remote mutation when it writes data.
Local project shells remain distinct from these remote sessions. Before asking the agent to run a command, name the project/host and whether the action is inspection or a change. See permissions.
Verify the tunnel end to end
Connect the SSH host, start the configured forward and make one bounded request through it from the intended local tool. Confirm the returned database or service identity. A connected SSH terminal does not by itself prove the forward reaches the right destination.
If connecting fails, distinguish the local listening address/port, SSH authentication and the destination as seen from the server. A port may already belong to another process; inspect it before stopping anything. When finished, stop the forward and confirm the local listener is no longer needed.
Use the supported database-discovery or Laravel Tinker panel only in the selected host/project context. Discovery can help populate a connection from application configuration, but the discovered password must remain in protected settings. Running Tinker is executing code on that application, so review the operation and environment before approving it.
Related guides: saved hosts, database connections.