Tunnel Connector

The Tunnel Connector lets Floogos run MySQL queries against a database on your shared hosting — the kind where the MySQL port is not reachable from the outside and there is no VPN or API. You drop a single PHP file on your hosting and Floogos talks to it over HTTPS, securely, without ever exposing your database.

How it works

Floogos  ──HTTPS POST──►  tunnel.php (your hosting)  ──PDO──►  MySQL (localhost)
             X-Tunnel-Secret

Floogos never connects to MySQL directly. It sends a query (as JSON) to tunnel.php over port 443 — which is already open on any web hosting — and the tunnel runs it locally with prepared statements and returns the rows.

Requirements

Any hosting with PHP 7.4+ and MySQL/MariaDB (shared hosting, cPanel, VPS…).
Access to upload a file (FTP/SFTP or the file manager).
The database user and password (the same your site already uses).

Step 1 — Generate your configuration

Fill in your database details below. The wizard generates a strong random secret and builds your tunnel.config.php. Everything runs in your browser — nothing is sent anywhere.

Configuration wizard

Fill in the details, generate the secret and download your tunnel.config.php. Everything runs in your browser — nothing is sent.

MySQL database Host Port User Password Database

Security Tunnel secret Allowed IPs (optional) Floogos server IP, comma-separated. Empty = any IP (not recommended).

Limit (req/min) Max body (KB)

Debug mode (development only) Allow DELETE on (tables, comma) Protected / read-only tables (comma)

Generated tunnel.config.php Download tunnel.php

⚠️ This file holds credentials: upload it via FTP/SFTP, never to a public repository, and ideally outside the webroot.

Step 2 — Upload the files

From the wizard above, download both files: tunnel.php (the connector, same for everyone) and your generated tunnel.config.php.
Upload both files to your hosting via FTP/SFTP or the file manager, for example under a folder like public_html/floogos/:
```
public_html/
  └── floogos/
        ├── tunnel.php
        └── tunnel.config.php
```
(Recommended) For extra safety, move tunnel.config.php outside the webroot and point to it from tunnel.php:
```
require_once '/home/youruser/config/tunnel.config.php';
```

Step 3 — Verify it works

From any terminal, send a test query (replace the URL and secret with yours):

curl -s -X POST https://your-domain.com/floogos/tunnel.php \
  -H "Content-Type: application/json" \
  -H "X-Tunnel-Secret: your-secret" \
  -d '{"sql":"SELECT 1 AS ping","params":{}}'

Expected response:

{ "ok": true, "rows": [{ "ping": 1 }], "insertId": null, "rowCount": 1 }

Then, in Floogos, create a Tunnel credential with your tunnel.php URL and the same secret, and you can query your hosting database from any workflow.

Security model

The tunnel applies 8 security layers before any query reaches your database:

#	Layer	What it does
1	Method	Only `POST` is accepted.
2	Authentication	`X-Tunnel-Secret` compared with `hash_equals()` (timing-safe), random delay on failure.
3	IP whitelist	Optional `TUNNEL_ALLOWED_IPS` to restrict which servers can call.
4	Rate limiting	Token bucket per minute (default 300).
5	Body size	Max body size (default 64 KB).
6	SQL validation	Blocks DDL/DCL, multi-statements and dangerous keywords (see below).
7	Strict PDO	`MULTI_STATEMENTS = false`, strict `sql_mode`.
8	Prepared statements	Parameterized always — immune to SQL injection.

All blocked attempts are written to the audit log.

What queries are allowed

Statement	Allowed
`SELECT`, `INSERT`, `UPDATE`	✅ Yes (UPDATE/INSERT not on protected tables)
`DELETE`	⚠️ Only on whitelisted tables
`DROP`, `ALTER`, `TRUNCATE`, `CREATE`, `GRANT`, `CALL`, `LOCK`	❌ Always blocked

Dangerous keywords such as INTO OUTFILE, LOAD_FILE(, SLEEP(, BENCHMARK(, mysql.user and multi-statement queries are rejected. You can mark tables as read-only (e.g. users, permissions, tokens) so the tunnel can never write to them.

Troubleshooting

403 Forbidden — the secret does not match, or the caller IP is not in TUNNEL_ALLOWED_IPS.
Timeout — check that your tunnel.php URL is reachable over HTTPS from the internet.
“Multi-statement not allowed” — remove the ; in the middle of the query.
“DELETE not allowed on table X” — add the table to the DELETE whitelist in tunnel.php if it is legitimate.