bm tunnel CLI reference

Status

bm ships as a single static Go binary, so it runs in slim containers and on PaaS build images without extra libraries.

Port-forward mode

The core command maps a local port to a remote host and port:

bm tunnel LOCAL_PORT:REMOTE_HOST:REMOTE_PORT

# Postgres
bm tunnel 5432:db.example.com:5432

# MySQL
bm tunnel 3306:mysql.example.com:3306

# SSH
bm tunnel 2222:server.example.com:22

Each connection to the local port opens one new connection through the proxy. TLS between your driver and the database runs inside it. Because the driver connects to 127.0.0.1, tell it the real server name for certificate checks. The databases guide shows how for each driver.

Transparent mode

Transparent mode is planned for apps that should keep their existing connection strings, with real host names instead of 127.0.0.1. Its interface and how it captures connections are not final. Until it ships, use port-forward mode or SOCKS5.

Config file

bm reads a local config file. The planned contents are your app credentials, the region endpoint, and the tunnels to open. Because the file holds everything, startup does not depend on any Fixedmark API. Some tunnel tools fetch their config from the vendor's API at boot, so an API outage stops the app from starting. bm avoids that.

Treat the file as a secret. It contains your token. Keep it out of source control and mount it from your platform's secret store. The file name and format will be documented at launch.

Running beside your app

The tunnel must run for as long as your app does. On platforms with a single start command, start it in the background first:

# Procfile or start command (illustrative)
web: bm tunnel 5432:db.example.com:5432 & node server.js

• Your app may start before the tunnel listens. Retry the first database connection, which most pools do already.
• Serverless functions cannot run a background process. Use SOCKS5 there instead.
• In CI, start the tunnel in one step and run migrations in the next.

bm logs

The build plan also lists bm logs --tail for following connection logs from the terminal: destination, SNI, bytes, egress IP, and result. It is planned alongside the dashboard's live log view.

How it connects

The CLI is planned to reach the proxy over SOCKS5 wrapped in TLS on a separate port, so your token is never sent in clear text. The proxy then connects to the remote host from your static IP, after checking your token's destination allowlist. See limits and security.