# Tunneled Git Connections

When hosting a self-hosted Git server like GitLab behind Pomerium, you can protect desktop client access to the source code with the same identity-aware access as the web interface using an encrypted TCP tunnel.

# Basic Connection

  1. Create a TCP tunnel, using either pomerium-cli or the Pomerium Desktop client. These examples use Git connections over SSH:

  2. Clone the repository using the tunneled connection as a remote:

    git clone ssh://git@

Now when you first initiate a pull, push, or fetch command your web browser will open to authenticate and authorize the connection.

# Always Tunnel through Pomerium

Because Git uses the SSH protocol, we can define a Host block in our local SSH configuration file to initiate the tunneled connection whenever it's needed.

  1. Open your local SSH configuration file at ~/.ssh/config and add a new Hosts block:

    Host git-tunnel
      HostName git.corp.example.com
      User git
      ProxyCommand pomerium-cli tcp --listen - %h:%p
  2. For each repository, clone using this host:

    git clone git@git-tunnel:userName/projectName


If you've already defined an SSH configuration for all domains managed by Pomerium as described in our SSH Example, you can skip the first step above and define your new remote with the Git server's domain name.

# More Resources