Reach a server-side service
4 minute read · SSH Terminal
A tunnel lets a local tool reach a service through an SSH server. Use it when the database should not be directly exposed to your computer’s network.
- Reach a private database through a saved host
- Manage explicit forwarding
- Discover project configuration without leaking it
- Verify the tunnel end to end
- Port forwarding dialog
- Tinker controls
Reach a private database through a saved host
First verify that the SSH host can connect with the intended user. In the database connection, choose that saved host for the tunnel and specify the database address as reachable from the remote side. A database listening on the remote machine's loopback is different from a database on your laptop's loopback.
Connect, inspect the expected schema and read a small known row. If SSH succeeds but the database times out, check the tunnel destination and server-side reachability. If the database rejects authentication, check the database credentials separately from the SSH key.
Reusing a host avoids entering the same SSH identity in several places. It does not grant a new database privilege or make every port on that server appropriate to access.
Manage explicit forwarding
Use the port-forward controls to define the source/listening port and destination. Choose an unused local port and understand which interface is exposed. Start the forward, test the intended service and stop it when finished. If a port is occupied, identify the existing process or forward before replacing it.
A forward depends on the relevant connection and local desktop being available. It is not a permanently hosted proxy. Avoid leaving a local development service exposed more broadly than the task needs.
Discover project configuration without leaking it
Supported database discovery can read an app's configuration through SSH and turn it into a saved SQL connection. Confirm the project and environment before the read, and keep discovered passwords out of chat output. A Laravel Tinker operation can execute application code; it requires the same scrutiny as another remote mutation when it writes data.
Local project shells remain distinct from these remote sessions. Before asking the agent to run a command, name the project/host and whether the action is inspection or a change. See permissions.
Verify the tunnel end to end
Connect the SSH host, start the configured forward and make one bounded request through it from the intended local tool. Confirm the returned database or service identity. A connected SSH terminal does not by itself prove the forward reaches the right destination.
If connecting fails, distinguish the local listening address/port, SSH authentication and the destination as seen from the server. A port may already belong to another process; inspect it before stopping anything. When finished, stop the forward and confirm the local listener is no longer needed.
Use the supported database-discovery or Laravel Tinker panel only in the selected host/project context. Discovery can help populate a connection from application configuration, but the discovered password must remain in protected settings. Running Tinker is executing code on that application, so review the operation and environment before approving it.
Related guides: saved hosts, database connections.
Port forwarding dialog
Open forwarding from the intended SSH session. The dialog lists active forwards for that connection.
| Field / action | Meaning |
|---|---|
| Type: Local | Opens a local listener and sends its traffic through SSH to the destination reachable from the server. Initial type is Local. |
| Type: Remote | Requests a listener on the remote side and forwards it through the session. The SSH server's forwarding policy applies. |
| Type: Dynamic | Creates a SOCKS-style forwarding endpoint; it does not use a fixed destination host/port. |
| Listen port | Listener port, initially 8080. Zero requests an automatically assigned port where supported; use the actual returned port afterward. |
| Destination host | Target reachable from the appropriate side of the tunnel; initially 127.0.0.1. |
| Destination port | Target service port, initially 3306. For PostgreSQL it may instead be 5432, according to that server's configuration. |
| Start | Creates the requested forward and reports the actual listener or an error. |
| Remove / stop forward | Stops the selected forwarding rule. It does not delete the saved SSH host or destination database. |
| Close dialog | Closes the controls; inspect the active-forward list when you need to confirm a tunnel has stopped. |
For example, a local port 15432 can forward to a PostgreSQL service at 127.0.0.1:5432 on the SSH server. Connect the database client to the actual local listener. A bind conflict means another process already owns the chosen port.
Tinker controls
Tinker is for PHP/Laravel execution in the chosen project. Browse for project selects the folder; Go to parent folder navigates that picker. The editor accepts PHP/Laravel code; executing it can read or modify application data. Snippets…, Snippet name and Save snippet manage reusable input. Clear Tinker output clears the displayed output, not database changes. Drag the editor/output divider to resize the two areas. Check the project and environment before running a snippet. See project runtime.