Piko

lastmod 2024-05-27created 2024-05-204 edits

An open-source alternative to Ngrok, designed to serve production traffic and be simple to host (particularly on Kubernetes)

Open-source alternative to Ngrok

Features

Reverse proxy that tunnels to external networks
Handles production-grade traffic and is designed to be simple to host (particularly on Kubernetes)
Can expose services in customer networks or BYOC (Bring Your Own Cloud) services, or connect to IoT devices
Can be hosted as a cluster of nodes for fault tolerance, scalability, and zero-downtime deployments

Upstream services connect to Piko and register endpoints
Piko routes requests for an endpoint to the registered upstream services over outbound-only connections
This means services can be exposed without opening public ports
Incoming HTTP(S) requests identify the ID of the target endpoint using the Host header or the x-pico-endpoint header
If multiple upstream services register the same endpoint, Piko load balances requests for that endpoint across the registered upstreams

Piko is designed to handle production traffic, not as a testing and development tool
Piko can be used to access customer networks, build BYOC solutions, and access IoT devices
To support this, Piko can run as a cluster of nodes for fault tolerance, horizontal scaling, and zero-downtime deployments
It also provides observability tools for monitoring and debugging

Piko is designed to be easy to host on Kubernetes
A Piko cluster can be hosted as a Kubernetes StatefulSet behind an HTTP load balancer or a Kubernetes Gateway
Upstream service connections and proxy client requests can be load balanced across any node in the cluster, and Piko manages routing requests to the correct upstream

Upstream services connect to Piko over outbound-only connections
Piko routes all requests to the upstream over that connection
Therefore upstreams don't need to open ports to receive requests
Piko supports authenticating upstream services before they register endpoints
Since Piko can be self-hosted, it can be hosted on the same network as the proxy clients so that it doesn't accept requests from external networks
For example, you can let authenticated upstream services register from the internet over TLS, then provide an internal route only to proxy clients on the same network as Piko

author Zer0 sitemap