Tunnels
Configure callbacks, hosts and HTTPS
Make host checks, webhooks, sign-in callbacks, local HTTPS and live reload work through your tunnel.
Allow the public host in your app
#Groundhog passes on the visitor’s Host, such as shop-dev.groundhog.unifinity.com, and adds X-Forwarded-Proto: https, X-Forwarded-Host and X-Forwarded-For. Set up host checks and trusted proxy handling in your framework before you rely on these headers for redirects.
For Vite, add the exact public host to server.allowedHosts. Aspire can pass tunnel.Resource.PublicHost to your app in an environment variable. Avoid allowing every host.
Register webhooks and sign-in callbacks
#Register your public address plus the callback path, for example https://shop-dev.groundhog.unifinity.com/webhooks or /signin-callback. Sign-in providers need the exact redirect address, so check your app builds public HTTPS redirects rather than localhost ones.
Check webhook signatures in your app. After a rename, update callbacks, signature base addresses and allowed hosts. The connection key only identifies the client; your app still decides who visitors are.
Choose the local transport
#Use --port 5173 to forward to a local HTTP app, or --target https://localhost:7132 for a local HTTPS app. Use one or the other. For ASP.NET Core, trust the development certificate:
dotnet dev-certs https --trust- --local-ca trusts a private or self-signed certificate: pass its public PEM or DER file. Hostname, expiry and purpose checks still apply.
- --insecure-local skips certificate checks for HTTPS on your own computer only. It never relaxes the connection to the Groundhog service.
The certificate is checked against the local hostname, even though the Host header carries the public one. Visitors get HTTPS even when your local app uses HTTP.
Make live reload and streaming work
#WebSockets, SignalR and server-sent events pass through the tunnel. If a Vite page loads but hot reload fails, check the browser’s WebSocket address: it must use wss on port 443 at the public host, not localhost. Configure the hot-reload client separately from the local server if you need to.
For endpoint selection, address injection and request logging in Aspire, see the Aspire integration reference. To embed the client or use your own credentials, see the agent library guide.