A real SSH workspace, next to your projects
The projects you run locally ship somewhere. Save the server once and open a workspace: a real terminal, an SFTP browser with inline editing, and tunnels you start with a click.
Share the workspace
How do I connect to a remote database over an SSH tunnel?
Local port forwarding is the standard route: ssh -N -L 127.0.0.1:15432:db.internal:5432 deploy@bastion opens a listener on your Mac that carries traffic to the remote database through the bastion, and your client then connects to 127.0.0.1:15432 as though the database were local. The flags end up in shell history, and nothing tells you whether the forward survived the laptop sleeping. PortBay includes a full SSH client where that forward is a saved row you start and stop with a click, beside an interactive terminal (a real PTY, not a command builder), an SFTP browser with an inline editor that saves back over SFTP with ⌘S, and host process and listening-port panels. Key auth rides system OpenSSH, so your ~/.ssh/config, IdentityFile entries, agent and ProxyJump chains work unchanged, and private keys are never stored in PortBay's registry. Local forwards and one bastion hop are free.
Verified against the product, 2026-07-10.
Terminal, files and tunnels, one host card
A saved host opens as a workspace: the terminal is a real PTY, the file browser edits over SFTP, and the tunnel row forwards a remote database to localhost.
From saved host to working session
- Save the host
- Open the terminal
- Forward what you need
- Open the database like a local one
- Edit and deploy
Save the host
Hostname or ~/.ssh/config alias, user, key or password. Aliases inherit everything OpenSSH already knows: ProxyCommand, certificates, agent keys, jump hosts.
Host prod-1 → [email protected]Open the terminal
A real PTY on the host with your shell, not a wrapped command runner. The health probe shows latency and host-key trust before you type.
Forward what you need
Click a saved tunnel to pull a remote service onto your Mac. The equivalent ssh command stays visible for auditability.
ssh -N -L 127.0.0.1:15432:db.internal:5432 deploy@bastionOpen the database like a local one
After a forward is live, Open DB client registers the tunneled port as a database connection: the same client flow as a local instance, pointed at 127.0.0.1.
Edit and deploy
Fix a config file inline over SFTP with ⌘S. For heavier work PortBay generates the exact Remote-SSH, rsync, scp or git pull command instead of reimplementing those tools.
rsync -az --progress -e "ssh" ./dist deploy@prod-1:/var/wwwSSH, tier by tier
The core remote-database workflow ships free.
Tunnels that survive idle connections and come back when the network drops.
Key material never enters PortBay's registry; key auth uses system OpenSSH, passwords live in the macOS keychain.
The three-tab-and-a-sticky-note workflow
Without a workspace, every host is a pile of terminal tabs, remembered flags and a mental map of which forward runs where.
One workspace per host: the tunnel state is visible, the terminal is right there, and the file edit saves back over SFTP.
$ ssh -N -L 127.0.0.1:15432:db.internal:5432 deploy@bastion &# which tab was that in? is it still up after the laptop slept? $ ssh [email protected] 'tail -f /var/log/app.log' # tab two$ sftp [email protected] # tab threesftp> get .env.production # edit locally, put it back, hope # The flags live in shell history and a sticky note.
One app, not a stack of tools
Public tunnels
One click gives a project a public HTTPS URL through Cloudflare's free tier: bundled cloudflared, no account, gone when you stop sharing.
Explore →HTTP inspector
A DevTools-style live table of every request through the Caddy edge, with filters, header detail, opt-in body capture and a dump viewer.
Explore →Local databases
Six engines, one wizard: isolated data dirs, dedicated ports, supervision, and connection vars injected into linked projects on start.
Explore →Asked before downloading
Does it replace my terminal and my SSH config?
PortBay's SSH workspace rides both. The workspace terminal is a real PTY, and key auth uses system OpenSSH, so ~/.ssh/config, IdentityFile entries, your agent, ProxyJump and provider-generated aliases keep working exactly as in Terminal. If ssh host-alias works there, PortBay can use the same alias.
Where does PortBay store SSH keys and passwords?
Private keys are never stored in PortBay's registry; the key path stays on system OpenSSH. The registry keeps only connection coordinates (host, port, user, forward type, jump host, optional key path). Password auth is stored in the macOS keychain under PortBay SSH.
Does PortBay's SSH workspace work with Teleport, Boundary or AWS SSM?
Yes, through the host-alias workflow. Let the provider's CLI write its OpenSSH config (tsh config, boundary connect ProxyCommand, aws ssm start-session ProxyCommand), then point PortBay's SSH host field at the resulting alias. PortBay layers the workspace and tunnels on top.
Can I reach a remote database through a PortBay SSH tunnel?
Reaching a remote database through an SSH tunnel ships free: save a local forward (with one bastion hop if needed), start it with a click, then Open DB client registers 127.0.0.1 with the forwarded port as a database connection and opens the built-in client, the same flow as a local instance.
What does the SSH workspace not do?
PortBay's SSH workspace is not a VPN replacement, cloud GPU provisioning or Slurm job submission. For heavy remote development it generates the exact Remote-SSH, rsync, scp or git commands for the tools that already handle every SSH edge case, instead of reimplementing them.
Give your projects and your agents a real local home.
Download for macOSFree & open source · macOS 11+ on Apple Silicon · Pro from $10/mo