Get started

How Groundhog works

How a request reaches the app on your computer, which name, address and key does which job, and who can do what.

What Groundhog does

#

Groundhog gives an app running on your computer a public HTTPS address. A visitor opens the address, the Groundhog service forwards the request to your computer, and your app sends the response.

How a request reaches your app: a visitor opens the public address, the Groundhog service forwards it, and your computer answersA visitorOpens your public addressGroundhog serviceForwards the requestYour computerThe client passes it toyour app, which answersHTTPStunnelYour computer opens the tunnel outward, so it needs no inbound firewall rule or port forwarding.

The Groundhog client on your computer opens an outbound, encrypted WebSocket connection to the Groundhog service, which is also called the relay. Requests travel inside that connection, several at a time over HTTP/2, and responses come back the same way. Your computer needs no inbound firewall rule or router port forwarding.

Request and response bodies stream in both directions, and WebSockets and server-sent events work too. Groundhog forwards your app; it does not deploy it, so keep your app and the client running while you test.

Follow the four steps to a working tunnel

#
Four steps to a working tunnel: a workspace, a tunnel, a connected client, and a check of the public address1. WorkspaceSign inCreate or join one2. TunnelChoose a unique nameSave the one-time key3. ClientStart your local appConnect with Aspire or the CLI4. CheckWait for ConnectedOpen the public addressKeep your app and the client running. The tunnel forwards requests; it does not deploy your app.

Give each name and address the right job

#

Groundhog uses five different values. Mixing them up is the most common reason a first connection fails.

Names and addresses
ValueExampleWhat it is for
Workspace addressweb-teamPicks the workspace in dashboard paths such as /w/web-team/tunnels.
Tunnel nameshop-devUnique across the whole Groundhog service. You enter it in the client.
Public addresshttps://shop-dev.groundhog.unifinity.comWhere visitors reach your app.
Service addresshttps://groundhog.unifinity.comWhere the client connects to the relay. Normally automatic.
Local targethttp://localhost:5173Where the client sends requests on your computer.

Public addresses use only the tunnel name. Your workspace address never appears in them.

Understand the three kinds of access

#
Three separate kinds of access: workspace membership, a tunnel’s connection key, and public access for visitorsWorkspace membershipYou sign in to the dashboardOwners manage the teamMembers see saved trafficCreators manage their keysConnection keyA client connects a tunnelOne key for one tunnelSeparate from any sign-inRotate it to replace accessPublic accessVisitors open the addressNo Groundhog account neededYour app checks who they areSigning in never connects a tunnel, and a connection key never opens the dashboard.
  • Workspace membership comes from signing in to the dashboard. Every member can see the workspace’s tunnels and saved traffic.
  • A connection key lets a client host one tunnel. It works independently of anyone’s sign-in.
  • Visitors reach your app at its public address without a Groundhog account or a key.

Removing someone from a workspace does not change keys they already know: rotate those keys as well. See Remove a member.

Guides checked against Groundhog client 0.4.0-preview.7.Groundhog is open source under the MIT licence.