connic bridge

Connect your private infrastructure to connic cloud. The connic bridge runs inside your network (VPC, on-prem, etc.) and creates a secure outbound tunnel to the connic relay. No inbound firewall rules required.

Quick Start

Docker (recommended)

docker run -d --name connic-bridge --restart unless-stopped \
  -e BRIDGE_TOKEN=cbr_your_token_here \
  -e ALLOWED_HOSTS=kafka:9092,postgres:5432 \
  connicorg/bridge:latest

pip

pip install connic-bridge

connic-bridge \
  --token cbr_your_token_here \
  --allow kafka:9092 \
  --allow postgres:5432

The agent reconnects after network interruptions but exits when the relay rejects its token or the project has no active deployment. Run the pip agent under a service manager that starts it again, such as a macOS LaunchAgent with KeepAlive or a systemd unit with Restart=always. See running the bridge as a service for both files.

Configuration

How It Works

1. The connic bridge establishes an outbound WebSocket connection to the connic relay service. No inbound ports need to be opened.
2. When a connic connector (e.g. Kafka, PostgreSQL) needs to reach a private endpoint, the relay asks the bridge to open a TCP connection.
3. If an allowed hosts list is configured, the bridge validates the target against it, then opens a local TCP connection and proxies data bidirectionally.
4. All traffic is encrypted via WSS (TLS).

Connect Services That Discover Endpoints

Some clients receive a different hostname or IP address after their first connection. Automatic destination routes send those follow-up connections through the correct bridge without requiring changes to your client code.

Configure routes under Project Settings → Bridge. To restrict what the bridge can reach, add every permitted host:port to ALLOWED_HOSTS. When the variable is unset or empty, every host reachable from the bridge's network is allowed.

See the automatic destination routes guide for setup instructions, API usage, supported patterns, and limits.

Security

• Outbound-only - the bridge never accepts inbound connections.
• Optional allowed hosts - set an exact host:port allowlist to restrict access. Without one, the bridge can reach any host available from its network.
• Token authentication - each bridge is tied to a single connic project.
• TLS encryption - all relay communication uses WSS.