rickgonzalez/MCAStation — MCAStation – SSH Tunnel Manager for AWS RDS
Transcript
QuickFacts
Let's dive into MCAStation — a friendly desktop tool that turns the tedious ritual of SSH tunneling to AWS databases into a single-click experience.
PlainEnglish
Think of MCAStation as a universal remote for your team's database access patterns. If you juggle multiple projects with dev, staging, and prod RDS instances hidden behind bastion jump hosts, the traditional workflow is a tangle of terminal tabs and aws commands. This app consolidates that into one window. It manages your environments, wakes up bastions, spawns SSH tunnels, and fetches secrets — all automatically. Plus, it guarantees that when you quit, every ssh process dies cleanly, so you never have orphaned tunnels hogging your ports.
QuickFacts
The stack is Electron forty-three plus React eighteen — a classic desktop app recipe. TypeScript ensures the main and renderer processes speak the same language through typed IPC contracts. Configuration lives in a local SQLite database managed by better-sqlite-three, and Vite handles the build. Twenty-five hundred lines of code across sixty-seven files.
Architecture
The architecture follows Electron's three-process security model. The renderer is a sandboxed React UI with no Node access — it can only talk to the main process through a whitelist of IPC channels. The preload script acts as the security bridge, exposing exactly the methods the UI needs on window dot bastion. The main process owns everything privileged: it manages the SQLite config database, orchestrates the tunnel state machine, and spawns child processes — ssh for the tunnels and aws for bastion control. This keeps credentials and spawned processes out of the renderer entirely.
Architecture
Here's where everything lives. The main folder holds the privileged backend: main dot t-s boots the app, config manages the SQLite database, tunnel orchestrates the SSH state machine, health runs the TCP probe loop, and ipc registers the handlers. Preload is the security bridge — one tiny file that exposes the whitelist API. Renderer is the sandboxed React UI. And shared defines the types and channel names that both sides agree on.
Architecture
Let's trace what happens when you click Start tunnel. The UI sends an IPC invoke to the main process. Main delegates to the TunnelManager, which first wakes the bastion by shelling out aws ec2 start-instances, then waits for it to be running. Once it has the bastion's public IP, it spawns an ssh dash N dash L process to open the tunnel. The TunnelManager tracks the child PID and starts a TCP probe loop that checks the local port every three seconds. When the port accepts its first connection, TunnelManager emits a status event back to the UI. The glyph turns green and you're connected.
Architecture
The pinning system solves a specific problem. Most database tools default to port fifty-four thirty-two, but you can't bind multiple tunnels to the same port. So each environment has a natural port — fifty-four thirty-two, fifty-four thirty-three, and so on — but you can pin one to always take fifty-four thirty-two. It's like assigning a reserved parking spot. When you pin a new environment, the app stops the old tenant's tunnel, rebinds it to its overflow port, pins the new one, and restarts it on fifty-four thirty-two. Only one environment gets the prime spot.
Architecture
When you click Copy connection string, the app shells out to AWS Secrets Manager to fetch the database credentials. It builds a postgres URL with the username and password, writes it straight to the clipboard, and schedules an auto-clear after thirty seconds. The password is never stored in SQLite, never displayed on screen, and never logged — it goes from Secrets Manager to your clipboard to your database tool, then disappears.
Architecture
The cleanup hooks are a safety net. When you quit the app — or it crashes, or the OS sends a terminate signal — main dot t-s calls killAll, which sends SIGTERM to every tracked ssh process. Orphaned ssh dash N tunnels are a classic footgun: they hold the port and you can't bind again until you hunt down the PID manually. This app guarantees that never happens.
Community
This is a solo project by Rick Gonzalez. The last commit was today — the repo is fresh and active. One branch, no tags yet. It's early days, but the foundations are solid and the code is production-ready for internal team use.
How this was made
Lenzon read rickgonzalez/MCAStation and generated this walkthrough automatically. The narration above is the transcript of what it says.
Explain a pull request from your own repo
Point Lenzon at a repo or a pull request and get a narrated walkthrough like this one.
Try it