RelayBar: A Native macOS Menu-Bar Manager for SSH Port Forwards

RelayBar: A Native macOS Menu-Bar Manager for SSH Port Forwards

RelayBar provides a graphical interface for managing local SSH port forwards directly from the macOS menu bar, eliminating the need to manually manage terminal sessions for tunnel persistence. It functions as a lightweight wrapper around the native /usr/bin/ssh binary, ensuring compatibility with existing system SSH configurations.

Core Functionality and Tunnel Management

RelayBar streamlines the creation and execution of SSH tunnels through a native macOS interface. The application allows users to import common SSH commands (e.g., ssh -N -L 8080:localhost:3000 user@host) or manually define tunnels using a dedicated form with five input fields.

Key operational features include:

  • One-Click Control: Users can start or stop individual tunnels with a single click.
  • Browser Integration: The app can simultaneously start a tunnel and open the associated local URL in the default web browser.
  • Connection Resilience: To handle unstable connections, RelayBar implements an automatic retry mechanism that attempts to reconnect up to 10 times using exponential backoff.
  • Error Visibility: Startup failures are displayed directly adjacent to the tunnel entry for immediate troubleshooting.
  • Lifecycle Management: All child SSH processes are automatically terminated when the RelayBar application quits.

Security Architecture and Constraints

RelayBar is designed with a security-first approach to prevent arbitrary command execution. It intentionally avoids invoking a shell and restricts the types of SSH options it allows.

Command Filtering

While the app preserves safe connection options such as -p (port), -J (jump host), -i (identity file), and a specific subset of -o values, it explicitly rejects options that could execute local commands, select arbitrary configuration files, or write logs.

System Integration

RelayBar is distributed outside the Mac App Store and is not sandboxed. This design choice allows the application to behave like the standard command-line client, providing the following integrations:

  • SSH Configuration: It reads the user's ~/.ssh/config and known_hosts files.
  • Identity Management: It supports configured identity files and inherits access to the user's SSH agent.
  • Authentication: Because SSH runs non-interactively, password prompts are not supported; users must rely on SSH keys or agents.

Technical Specifications and Build Process

RelayBar requires macOS 13 or newer and the Xcode command-line tools for compilation. Tunnel definitions are stored locally using UserDefaults.

For developers building from source, the project includes scripts to automate the build and signing process:

  • build-app.sh: Compiles the app and signs it using the first valid Developer ID Application certificate found in the login keychain with the hardened runtime.
  • package-release.sh: Creates a signed ZIP archive of the application.
  • notarize-release.sh: Handles the notarization process via notarytool to ensure the app passes macOS Gatekeeper without warnings.

Community Insights and Extensions

Following its release, the community has highlighted several use cases and potential improvements for the tool:

  • Linux Port: A community member has already initiated a rebuild of the tool for Linux users.
  • Feature Requests: Users have suggested adding connection grouping or folders to manage environments for those juggling dozens of different tunnels.
  • Planned Updates: The author, linxy97, has indicated plans to add support for viewing remote images and markdown files by pasting absolute paths directly into the menu bar.

Regarding connection stability, some users noted a preference for autossh in environments with highly unstable internet, though RelayBar's built-in exponential backoff is designed to mitigate similar issues.

Sources