The macOS menu bar for freelance cloud engineers and independent DevOps consultants. Manage GCP IAP, AWS SSM, Cloud SQL Proxy and SSH tunnels across every client account — without the CLI ceremony, re-auth dance, or alt-tab tax.
brew install fourninecs/tap/cloudtunnels
Every minute lost to gcloud auth login, aws sso login --profile=, and figuring out which port collides with what — that's time you can't put on an invoice. Run the numbers for yourself.
If you're on a salary at one company with one GCP project, you don't need this. If half your terminal history is gcloud config configurations activate, you do.
Each client has their own GCP org, AWS org, naming conventions, and tunnel scripts. You spend the first 15 minutes of every session re-authing and finding the right port.
You're paid to deliver, not to remember which kubeconfig wants proxy-url set. Auth tokens expire mid-flow and silently break psql sessions.
You don't have a platform team. The thing standing between you and a 2 a.m. page is a ~/notes/tunnels.md file you wrote six months ago.
Each provider has its own quirks — auth ceremony, port semantics, expiry behavior. CloudTunnels normalizes them. Status, retries, port allocation, kill semantics, account pinning: identical across all four.
gcloud compute start-iap-tunnel
Direct IAP tunnels to instances behind a private network — without typing the command every time, and without losing your account context.
aws ssm start-session
SSM-managed port-forwards, including bastion-to-RDS chains. SSO flows handled, region collisions impossible.
cloud-sql-proxy v2
v2 proxy with private IP, IAM database auth, and service account impersonation. As toggles, not flag stew.
ssh -D / -L · iap-wrapped
SOCKS5 proxies and local forwards from your existing ssh_config aliases. Optionally wrapped in IAP.
These aren't features in a brochure. They're the specific moments where the CLI bites you and you reach for a sticky note. Each one is a few minutes a day you stop losing.
3× retry with backoff on network drops or instance restart. Auth-expiry skips retry to avoid loop storms.
stderr watcher per provider. Token-revoked patterns surface a notification and pause retries before they fan out.
Add-Tunnel form fills the next free local port. A second Postgres tunnel doesn't collide with the first.
lsof -i :5432SSH/SOCKS tunnels set proxy-url on connect, unset on disconnect. No leaked stanzas across clients.
One-click open: k9s, psql, browser, RDP, VNC, MongoDB Compass — driven by tunnel kind. No more memorizing flags.
Next-meeting banner with Join (Zoom / Meet / Teams / Webex) and a pre-meeting ping while your tunnels stay up.
Stop opening jwt.io, port killers, base64 sites, online cert decoders. Everything you reach for during a debugging session is in the same window as your tunnels. Local-only — nothing leaves your machine.
Everything CloudTunnels does is technically possible with the raw provider tools and a folder of shell scripts. So here's the honest comparison.
| Raw CLI | Other tunnel managers | CloudTunnels | |
|---|---|---|---|
| Multi-account pinning per tunnel | Shell hacks | Global only | Per-tunnel |
| Auto-reconnect with backoff | Bash loops | Sometimes | 3× w/ backoff |
| Auth-expiry detection | Silent failures | Per provider | |
| Free-port detection | lsof + memory | ||
| Kubeconfig auto-patch | Manual edits | On up/down | |
| Integrated toolbox | jwt.io et al. | 23+ utilities | |
| Scriptable CLI | It is the CLI | ctun |
macOS 13 or later. Universal binary. Homebrew is the path of least resistance; source builds are documented for the people who want them.
brew install fourninecs/tap/cloudtunnels
# clone, build, install $ git clone https://github.com/FournineCS/cloud-tunnels.git $ cd cloud-tunnels $ make app # build/CloudTunnels.app $ make install # /Applications $ make install-cli # /usr/local/bin/ctun
# list every tunnel across every client $ ctun list NAME KIND PORT STATUS LAT prod-postgres-primary gcp-iap 5433 up 18ms staging-rds-bastion aws-ssm 5434 up 42ms analytics-replica cloud-sql 5435 up 11ms infra-jumphost-socks ssh 1080 up 9ms # start one in the background, get back to work $ ctun start prod-db --detach ✓ tunnel up · pid 48217 · :5433 → prod-db-01:5432 $ ctun status 4 active · 0 reconnecting · 0 failed $ ctun stop prod-db # also stops GUI tunnels — single source of truth
Open source.
Receipts welcome.
CloudTunnels is brand new and unapologetically targeted at a specific audience. As real users start running it across their clients, their words go here.