Switch default tunnel to bore (no token needed)

Dockerfile

@@ -8,7 +8,20 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
         curl ca-certificates bash \
     && rm -rf /var/lib/apt/lists/*
 
-# ngrok v3 (gives us a public TCP endpoint for Postgres) — pick the right arch
+# bore — open-source TCP tunnel, no signup (default). Arch-aware.
+RUN ARCH="$(dpkg --print-architecture)" \
+    && case "$ARCH" in \
+         amd64) BARCH=x86_64 ;; \
+         arm64) BARCH=aarch64 ;; \
+         *)     BARCH=x86_64 ;; \
+       esac \
+    && curl -fsSL "https://github.com/ekzhang/bore/releases/download/v0.6.0/bore-v0.6.0-${BARCH}-unknown-linux-musl.tar.gz" \
+        -o /tmp/bore.tgz \
+    && tar -xzf /tmp/bore.tgz -C /usr/local/bin \
+    && rm /tmp/bore.tgz \
+    && chmod +x /usr/local/bin/bore
+
+# ngrok v3 — optional alternative tunnel (used only if NGROK_AUTHTOKEN is set)
 RUN ARCH="$(dpkg --print-architecture)" \
     && curl -fsSL "https://bin.equinox.io/c/bNyj1mQVY4c/ngrok-v3-stable-linux-${ARCH}.tgz" \
         -o /tmp/ngrok.tgz \

README.md

@@ -14,40 +14,42 @@ A single Docker container that runs **PostgreSQL** + a small **web UI** that han
 **public connection URL** to drop into any demo project that needs a Postgres database.
 
 Because Hugging Face Spaces only exposes one HTTP port (no raw TCP), the container opens an
-outbound **ngrok TCP tunnel** so Postgres is reachable from anywhere with a normal
-`postgresql://…` URL and any client/ORM.
+outbound **TCP tunnel** so Postgres is reachable from anywhere with a normal `postgresql://…`
+URL and any client/ORM. The default tunnel is **[bore](https://github.com/ekzhang/bore)** —
+open-source, **no signup, no token**. Set `NGROK_AUTHTOKEN` to use ngrok instead.
 
-> ⚠️ **Ephemeral & throwaway.** Data is wiped on every restart/rebuild, and the public URL
-> changes each time. Great for demos; do not use for anything you need to keep.
+> ⚠️ **Throwaway by default.** The public URL changes on every restart. Data is **backed up**
+> (see Persistence) but treat the cluster itself as disposable.
 
 ---
 
 ## Deploy (5 minutes)
 
-1. **Get a free ngrok authtoken** — sign up at <https://dashboard.ngrok.com>, copy *Your Authtoken*.
-2. **Create a Space** → New Space → **SDK: Docker** → (recommended) **Visibility: Private**.
-3. **Push these files** to the Space repo (or upload them in the web UI):
+1. **Create a Space** → New Space → **SDK: Docker** → **Visibility: Public** (so keep-alive can
+   reach it; the UI is still password-locked).
+2. **Push these files** to the Space repo (or upload them in the web UI):
    `Dockerfile`, `start.sh`, `README.md`, and the `app/` folder.
-4. **Add Space secrets** (Settings → *Variables and secrets*):
+3. **Add Space secrets** (Settings → *Variables and secrets*):
    | Secret | Required | Purpose |
    |---|---|---|
-   | `NGROK_AUTHTOKEN` | ✅ | Opens the public TCP tunnel for Postgres |
    | `APP_PASSWORD` | recommended | Locks the web UI (Basic auth, user `admin`) so only you see the URL |
-   | `POSTGRES_PASSWORD` | optional | Fixed DB password (otherwise one is generated per boot) |
+   | `HF_TOKEN` + `HF_BACKUP_REPO` | for backups | Off-Space dumps to a private HF Dataset (see Persistence) |
+   | `POSTGRES_PASSWORD` | recommended | Fixed DB password (otherwise one is generated per boot) |
+   | `NGROK_AUTHTOKEN` | optional | Use ngrok instead of bore for the tunnel |
    | `POSTGRES_USER` / `POSTGRES_DB` | optional | Defaults: `demo` / `demo` |
-5. The Space builds and starts. Open it → the UI shows your **connection URL** + a Copy button.
+4. The Space builds and starts. Open it → the UI shows your **connection URL** + a Copy button.
 
 ## Use it
 
 Open the Space, copy the `postgresql://…` URL, and use it anywhere:
 
 ```bash
-psql "postgresql://demo:PASSWORD@0.tcp.ngrok.io:12345/demo"
+psql "postgresql://demo:PASSWORD@bore.pub:26134/demo"
 ```
 
 ```python
 import psycopg
-conn = psycopg.connect("postgresql://demo:PASSWORD@0.tcp.ngrok.io:12345/demo")
+conn = psycopg.connect("postgresql://demo:PASSWORD@bore.pub:26134/demo")
 ```
 
 Works the same with SQLAlchemy, Prisma, Drizzle, node-postgres, etc.

app/main.py

@@ -1,10 +1,10 @@
 import os
+import json
 import time
 import secrets
 import threading
 from datetime import datetime, timedelta
 
-import httpx
 import psycopg
 import gradio as gr
 
@@ -22,7 +22,7 @@ PG_PORT = os.environ.get("PGPORT", "5432")
 APP_PASSWORD = os.environ.get("APP_PASSWORD", "")
 APP_USER = os.environ.get("APP_USER", "admin")
 
-NGROK_API = "http://127.0.0.1:4040/api/tunnels"
+TUNNEL_FILE = "/tmp/tunnel.json"   # written by start.sh (bore or ngrok)
 
 BOOT = datetime.now()
 HISTORY: list[tuple[str, bool, bool]] = []   # (HH:MM:SS, postgres_up, tunnel_up)
@@ -34,13 +34,12 @@ KEEPALIVE = {"count": 0, "last": None, "src": "—"}
 
 # ---------------------------------------------------------------- helpers ----
 def get_tunnel():
-    """Return (host, port) of the public ngrok TCP tunnel, or None."""
+    """Return (host, port) of the public TCP tunnel from /tmp/tunnel.json, or None."""
     try:
-        r = httpx.get(NGROK_API, timeout=3)
-        for t in r.json().get("tunnels", []):
-            if t.get("proto") == "tcp":
-                host, port = t["public_url"].split("://", 1)[1].split(":")
-                return host, port
+        with open(TUNNEL_FILE) as f:
+            d = json.load(f)
+        if d.get("host") and d.get("port"):
+            return d["host"], str(d["port"])
     except Exception:
         return None
     return None
@@ -160,7 +159,7 @@ async def connection(_: None = Depends(require_auth)):
 def snapshot():
     tunnel = get_tunnel()
     up = pg_ok()
-    url = build_url(tunnel) or "— no public tunnel yet (set NGROK_AUTHTOKEN) —"
+    url = build_url(tunnel) or "— tunnel starting… refresh in a few seconds —"
     host, port = tunnel if tunnel else ("—", "—")
 
     samples = len(HISTORY)
@@ -189,8 +188,8 @@ def snapshot():
 with gr.Blocks(title="Remote Postgres — Uptime Watcher", theme=gr.themes.Soft()) as demo:
     gr.Markdown("# 🐘 Remote Postgres — Uptime Watcher")
     gr.Markdown(
-        "Throwaway Postgres for demo projects, exposed over an ngrok TCP tunnel. "
-        "Data is **ephemeral** and the URL **changes on every restart**."
+        "Throwaway Postgres for demo projects, exposed over a TCP tunnel (bore). "
+        "Data is backed up, but the URL **changes on every restart**."
     )
     status_box = gr.Markdown()
     url_box = gr.Textbox(

start.sh

@@ -79,14 +79,38 @@ if [ "$FRESH_INIT" = "1" ]; then
   python /app/backup.py restore || echo "[start] no restore performed"
 fi
 
-# ---- expose Postgres publicly via ngrok TCP tunnel ----
+# ---- expose Postgres publicly via a TCP tunnel ----
+# Default: bore (no signup). If NGROK_AUTHTOKEN is set, use ngrok instead.
+# Whichever runs writes the public endpoint to /tmp/tunnel.json for the web app.
+rm -f /tmp/tunnel.json
 if [ -n "${NGROK_AUTHTOKEN:-}" ]; then
-  echo "[start] Configuring ngrok and opening TCP tunnel for port $PGPORT"
+  echo "[start] Tunnel: ngrok (NGROK_AUTHTOKEN present)"
   ngrok config add-authtoken "$NGROK_AUTHTOKEN" >/dev/null 2>&1 || true
   ngrok tcp "$PGPORT" --log=stdout > "$HOME/ngrok.log" 2>&1 &
+  ( set +e
+    for _ in $(seq 1 30); do
+      pub="$(curl -fsS localhost:4040/api/tunnels 2>/dev/null | grep -oE 'tcp://[^"]+' | head -1)"
+      if [ -n "$pub" ]; then
+        hp="${pub#tcp://}"
+        printf '{"host":"%s","port":"%s","provider":"ngrok"}' "${hp%%:*}" "${hp##*:}" > /tmp/tunnel.json
+        echo "[start] ngrok tunnel up at ${hp}"; break
+      fi
+      sleep 1
+    done ) &
 else
-  echo "[start] NGROK_AUTHTOKEN not set — Postgres is only reachable INSIDE the Space."
-  echo "[start] Add a free ngrok authtoken as a Space secret to get a public URL."
+  BORE_HOST="${BORE_HOST:-bore.pub}"
+  echo "[start] Tunnel: bore -> ${BORE_HOST} (no token needed)"
+  bore local "$PGPORT" --to "$BORE_HOST" > "$HOME/bore.log" 2>&1 &
+  ( set +e
+    for _ in $(seq 1 30); do
+      port="$(grep -aoE 'listening at [^[:space:]]+:[0-9]+' "$HOME/bore.log" 2>/dev/null \
+              | grep -oE '[0-9]+$' | tail -1)"
+      if [ -n "$port" ]; then
+        printf '{"host":"%s","port":"%s","provider":"bore"}' "$BORE_HOST" "$port" > /tmp/tunnel.json
+        echo "[start] bore tunnel up at ${BORE_HOST}:${port}"; break
+      fi
+      sleep 1
+    done ) &
 fi
 
 # ---- keep the Space awake (free Spaces sleep after 48h with NO http traffic) ----