Self-hosted Tunneling Service: Replace ngrok with mygrok and a VPS

Why Build Your Own Tunnel Instead of Paying for ngrok

Tunneling services are incredibly useful for exposing local development servers to the internet, testing webhooks, or showcasing projects. However, commercial solutions like ngrok come with significant drawbacks for serious developers. They often require monthly subscriptions, assign temporary subdomains that change with each restart, impose session limits that interrupt debugging workflows, and route your traffic through third-party infrastructure you don't control.

A self-hosted tunneling service eliminates these constraints entirely. You own the server, the domain, the TLS certificates, and the authentication mechanism. There are no accounts to create, no free tiers to outgrow, and crucially, no vendor lock-in. This approach aligns perfectly with the growing trend of self-hosting critical developer tools, giving you full autonomy over your development infrastructure and networking setup.

Unlike basic SSH reverse tunnels, a purpose-built solution provides stable, memorable URLs, automated TLS certificate management, robust access controls, and resilience against network disruptions. It transforms tunneling from a temporary workaround into a reliable piece of your development workflow.

The Advantages Over Traditional Methods

While SSH reverse tunnels can achieve similar results, they lack polish and scalability. A dedicated self-hosted tunneling service offers a superior experience with features like web-based management interfaces, fine-grained access control, and seamless integration with modern authentication methods. It's the difference between a hastily assembled script and a production-grade tool.

Getting Started: Installing the Client and Server

The installation process is designed to be straightforward, whether you're setting up the client on your development machine or deploying the server on a VPS. Here's how to get both components running quickly.

Installing the Client

For macOS and Linux users, Homebrew provides the easiest installation path:

• brew install schappim/mygrok/mygrok

Alternatively, if you prefer to install directly from your own server, binaries can be downloaded with a simple command that automatically configures them with your server's address:

• curl -sSL https://tunnel.your-domain.com/install | bash

You can customize the installation directory by setting MYGROK_INSTALL_DIR=$HOME/bin. If you're a Go developer, you can also build and install the client directly:

• go install github.com/schappim/mygrok/cmd/mygrok@latest

Note that Homebrew and Go installations are generic and require configuration to point to your specific server using MYGROK_SERVER or a config file.

Deploying the Server

Deploying the server is a single command on a fresh Debian/Ubuntu system, compatible with providers like DigitalOcean, Hetzner, AWS EC2, Vultr, or even a Raspberry Pi:

• curl -sSL https://raw.githubusercontent.com/schappim/mygrok/main/deploy/install-server.sh | sudo bash -s -- --domain example.com --email [email protected]

This script handles everything: creating a service user, installing the binary, generating an authentication token, setting up a hardened systemd unit, configuring the firewall, and printing the necessary DNS records. Detailed walkthroughs for various cloud providers are available in the documentation.

60 Seconds to a Public URL

Once your server is deployed and configured, getting a public URL is remarkably fast. First, set your authentication token:

• export MYGROK_AUTHTOKEN="<the token your server printed>"

Then start tunneling a local port:

• mygrok http 3000 --subdomain=jarvis

To view active tunnels and monitor traffic:

• mygrok tunnel active

For long-term use, make the tunnel persistent:

• mygrok service install 3000 --subdomain=jarvis

This creates a launchd agent on macOS or a systemd unit on Linux, ensuring the tunnel starts automatically at boot or login, restarts on crashes, and securely stores the auth token.

Serving Static Content

If you need to share a folder without a running server, the serve command is perfect:

• mygrok serve # serves current directory at a random subdomain
• mygrok serve gallery ./photos # serves ./photos at gallery.example.com
• mygrok serve ./photos # serves locally at http://127.0.0.1:8080

Securing Your Tunnels

Security is paramount when exposing local services to the internet. A self-hosted tunneling solution provides multiple layers of protection beyond simple passwords.

Basic Authentication and IP Rules

You can easily add basic authentication to any tunnel:

• mygrok http 3000 --subdomain=secure --basic-auth=user:pass

IP-based access control allows you to restrict access to specific networks:

• mygrok http 3000 --subdomain=internal --allow-cidr=192.168.1.0/24

WebAuthn Passkeys

For enhanced security, modern WebAuthn passkeys provide phishing-resistant authentication. These can be managed through the web UI or CLI, offering a seamless yet secure experience for accessing protected tunnels.

Web-Based Management Interface

• View and manage active tunnels in real-time
• Monitor HTTP request logs and traffic metrics
• Configure access controls and authentication methods
• Manage user accounts and permissions
• Generate and revoke authentication tokens

The web UI makes it easy to administer your tunneling infrastructure without needing to remember complex CLI commands, making it accessible to team members who may not be comfortable with command-line tools.

Advanced Features and Use Cases

Beyond simple HTTP tunneling, this solution supports various advanced scenarios:

MCP Connectors

For developers working with AI assistants like Claude, MCP (Model Context Protocol) connectors allow local services to be exposed securely:

• mygrok mcp 8790 --subdomain=tools

This bridges the gap between local development environments and cloud-based AI tools, enabling powerful workflows without compromising security.

Custom Domains and Wildcard DNS

The server supports wildcard DNS configurations, allowing you to create unlimited subdomains dynamically. This is particularly useful for multi-tenant applications or when you need to provision temporary environments for testing.

Infrastructure Considerations

Running a self-hosted tunneling service requires minimal infrastructure. The smallest VPS plans from most providers are sufficient, typically costing just a few dollars per month. Key considerations include:

• Bandwidth: Monitor usage as tunnel traffic counts against your VPS bandwidth limits
• Storage: Sufficient space for TLS certificates and log files
• Networking: Open ports for HTTP/HTTPS traffic and proper firewall configuration
• Reliability: Choose a provider with good uptime guarantees for consistent access

Developer Tools Integration

As part of the broader ecosystem of developer tools, this tunneling solution complements other infrastructure components like CI/CD pipelines, container orchestration platforms, and monitoring systems. Its lightweight nature and minimal dependencies make it an ideal addition to any developer's toolkit.

Limitations and Considerations

While self-hosted tunneling offers many advantages, there are some limitations to consider:

• You are responsible for server maintenance, security updates, and monitoring
• Requires some technical knowledge to set up and troubleshoot
• Traffic routing goes through your infrastructure, potentially adding latency
• No built-in analytics or usage tracking compared to commercial solutions

However, for developers comfortable with basic server administration, these trade-offs are easily outweighed by the benefits of control, privacy, and cost savings.

Conclusion

Self-hosted tunneling represents a shift toward greater developer autonomy and control over development infrastructure. By eliminating dependency on third-party services, you gain not just cost savings but also peace of mind knowing your development workflows aren't subject to external constraints or policy changes.

Whether you're a solo developer building personal projects or part of a team managing multiple applications, investing time in setting up your own tunneling service pays dividends in flexibility, security, and long-term sustainability. The initial setup effort is quickly repaid through uninterrupted workflows and predictable costs.