PortLight

A macOS menu bar app for managing Cloud SQL Proxy connections.

While this may seem ever so slightly unnecessary, I'm jumping between connections a lot and need something dead simple. I am happy to replace juggling terminals, forgetting where or what I'm connected to, with a 1-2 click solution.

Features

Menu bar interface for quick connection management
Support for multiple database connections
Auto-connect on launch option
Real-time connection status monitoring

Requirements

macOS 14.0+
Cloud SQL Auth Proxy binary installed
GCP credentials configured (gcloud auth application-default login)

Installation

Quick Install (Terminal)

curl -L -o PortLight.dmg https://github.com/jwra/portlight/releases/latest/download/PortLight.dmg && open PortLight.dmg

Then drag PortLight to your Applications folder.

Manual Install

Download PortLight.dmg from the latest release
Open the DMG and drag PortLight to your Applications folder
Launch PortLight from Applications

First Launch

Since the app is not notarized, macOS will show a security warning on first launch:

Right-click (or Control-click) on PortLight in Applications
Select "Open" from the context menu
Click "Open" in the dialog that appears

This is only required once.

Configuration

On first launch, configure the path to your cloud-sql-proxy binary in the "Manage Connections" window.

Security Considerations

App Sandbox Disabled

PortLight has App Sandbox disabled (ENABLE_APP_SANDBOX = NO). This is a necessary trade-off for the app's core functionality:

Process Execution: The app must execute the cloud-sql-proxy binary, which requires spawning external processes
Network Management: Managing proxy connections requires low-level network socket operations
File System Access: The app needs to access the proxy binary from user-specified paths

Mitigations in place:

Hardened Runtime: The app uses Hardened Runtime for code signing, providing additional security protections
No Network Access: PortLight itself does not make network requests; all networking is handled by the cloud-sql-proxy binary
Local Only: The app only manages local proxy instances and does not transmit any data

Credential Handling

PortLight does not store or handle GCP credentials directly. It relies on the standard gcloud application-default credentials flow.

License

MIT License

jwra/portlight