Desktop application · cloud operations · 2025 – 2026

A one-click tunnel manager for Google Cloud VMs

A desktop app that replaces a folder of shell scripts and remembered commands with one checkbox per tunnel. It lists only the VMs your Google Cloud permissions allow, opens Identity-Aware Proxy tunnels to them, starts a stopped VM first, and opens a console with the gcloud tools ready for sign-in. One app for connecting, with access secure by default.

Organization
FilmLA
Year
2025 – 2026
1 checkbox
per tunnel, in place of shell scripts and remembered commands
Secure by default
access follows each user’s Google Cloud permissions
One app
tunnels, VM start-up and a gcloud console

Results

  • Tick a box to connect: no scripts to maintain and no commands to remember.
  • Shows only the VMs your Google Cloud permissions allow; everything else is denied.
  • Starts a stopped VM, waits for it, then connects.
  • Opens a gcloud console for sign-in and other tasks, so it is the one app you need.

My role

Designed and built the Windows app, its tests and its releases. Planning an Electron rebuild to ship one app on every OS.

Stack

  • C#
  • .NET 9
  • Windows Forms
  • Google Cloud SDK (gcloud)
  • Identity-Aware Proxy (IAP)
  • Cloud IAM
  • Unit tests
Diagram: a Windows desktop app signs in with Google Cloud, lists the VMs your permissions allow across projects and zones, and opens SSH, RDP and other tunnels on fixed local ports through Identity-Aware Proxy. A stopped VM is started before connecting, and a VM outside your permissions is shown as access denied. Background checks move each tunnel from Disconnected to Connected and flag a local port that is already in use. A built-in gcloud console opens with the tools ready. Names are made up.
Sign in once and tick a box: the app starts the VM, tunnels through IAP and keeps the port. A VM outside your permissions stays out of reach.

Why

Reaching a cloud VM through Identity-Aware Proxy needs no public IP or VPN, but it means a command per tunnel, per port, per session, and in practice a pile of shell scripts that each person keeps up to date. The app turns all of that into a checkbox.

Screenshot of the tunnel manager window: project and zone filters above a table of tunnels with columns for project, zone, machine, type (SSH or RDP), remote port, local port and status, and a checkbox on each row to connect. One RDP tunnel is connected. Connect All and Close All buttons sit below. Names and local ports have been replaced with stand-ins.
The app: one row per tunnel, ticked to connect. Project, zone and machine names and local ports are stand-ins.
  • Easy to use. Tick a box to connect and untick it to disconnect, from the window or the tray. No scripts to keep up and nothing to remember.
  • Secure by default. The app inherits each user’s Google Cloud permissions, so it lists only the VMs they may reach. Everything else is denied.
  • Built-in gcloud console. A console window opens with the gcloud tools ready, for signing in and anything else, so it is the one app people need.
  • VM auto-start. A stopped VM is started, polled until it reports running, then connected.
  • Persistent ports. Each tunnel keeps its local port across restarts, so shortcuts and saved connections keep working. A port taken by another program is flagged.

Next

The app is a self-contained Windows executable today. I plan to rebuild it in Electron so one app ships on every OS.