dbgate-central-proxy

Outbound proxy agent for DbGate Central. Run it inside a private network so DbGate Central can reach OData and GraphQL APIs that are not exposed to the public internet.

How it works

1. In DbGate Central, open Settings -> Connection proxies, create a proxy, and select the OData/GraphQL connections it may serve. You get a token.
2. Run this agent inside your network with that token. It connects outbound only (no inbound ports): it opens an SSE wait stream on the wake service and registers with DbGate Central.
3. When you use one of the selected connections, DbGate Central persists the request, wakes the agent, the agent pulls the request, checks its target origin against the allow-list embedded in the token, performs the fetch from inside your network, and posts the response back.

If the agent is not connected, DbGate Central falls back to a direct fetch.

Usage

npx dbgate-central-proxy --token <token>

Options:

• --token <token> (required) - the proxy token from DbGate Central.
• --central-url <url> - DbGate Central base URL (default https://central.dbgate.cloud).
• --wake-url <url> - wake service base URL (default https://api.dbgate.cloud).

Changing the connection selection in DbGate Central regenerates the token; restart the agent with the new token afterwards.

Security

The token carries a signed list of allowed (scheme, host, port) hashes. The agent refuses to forward any request whose target origin is not in that list. The token is the only credential; treat it as a secret.