# Tunnels

Source: https://laraport.app/docs/tunnels/

> Open the app's database or Redis on localhost for TablePlus, DBeaver or RedisInsight, relayed through its container, with nothing listening on the server.

A tunnel opens the app's database or Redis on your computer, so a desktop client can connect to it: TablePlus, DBeaver, RedisInsight. It works for PostgreSQL, MySQL, MariaDB and Redis.

## Opening one

On the Data tab of a Laravel container, choose **Tunnel to PostgreSQL**, **Tunnel to MySQL** (or MariaDB) or **Tunnel to Redis**. The entry appears when:

- the app's configuration names a database or Redis on a network host, not `localhost` or a socket;
- the container has PHP, which relays the connections.

The tunnel screen shows where to connect:

- **Connect to**: `127.0.0.1` and the local port;
- **Goes to**: the host and port the app uses, and the container that relays;
- the database and the user;
- a URL: `postgresql://…`, `mysql://…` or `redis://…`;
- how many connections are open, and the last connection that failed.

The password is never on screen.

| Key | Action |
|---|---|
| `u` | Copy the URL, with the password |
| `p` | Copy the password |
| `esc` | Close the tunnel and leave |

Copying goes through the terminal with the OSC 52 escape sequence, in terminals that support it. See [Troubleshooting](https://laraport.app/docs/troubleshooting/#copying-does-nothing).

## Ports

The tunnel listens on the server's port plus 10000, so clients can keep a saved connection:

| Service | Server port | Local port |
|---|---|---|
| PostgreSQL | 5432 | 15432 |
| MySQL, MariaDB | 3306 | 13306 |
| Redis | 6379 | 16379 |

When that port is taken, the tunnel picks a free one and the screen shows it.

## How it works

- The tunnel listens on `127.0.0.1` only, so only your computer can connect.
- Each connection runs `docker exec -i` in the app's container with a small PHP relay. The container resolves the database's host name and is on its network, so databases on a Swarm overlay network (Dokploy) are reached too.
- Nothing is installed on the server and no port is opened there.
- The tunnel stays open while its screen does. Leaving the screen closes the tunnel and every connection through it.
- A connection the relay cannot make is reported on the screen.

Tunnels are recorded in the [journal](https://laraport.app/docs/journal/). A [read-only server](https://laraport.app/docs/read-only/) refuses them, since a desktop client could change the data.