Connic Bridge: AI Agents for Private Infrastructure

A Kafka cluster may sit in a private VPC, with a Postgres database behind a corporate firewall and internal APIs reachable only via private DNS. None of these services are accessible from the public internet, and for good reason.

AI agents may still need to react to events in these systems: process Kafka messages, listen for database changes, and call internal services. This requires bridging a cloud-hosted agent platform and infrastructure that was designed to be unreachable.

The Problem With Traditional Approaches

Teams typically reach for one of a few options when connecting cloud services to private infrastructure. Each has real downsides:

Cloud agents need a way to reach private services without making those services reachable from the internet. Connic Bridge provides that connection.

How Connic Bridge Works

The Connic Bridge is a lightweight agent that runs inside the private network. It makes a single outbound WebSocket connection to the Connic relay, without requiring inbound ports, a VPN, or public exposure.

When a Connic connector needs to reach a service in the private network, the relay forwards the request through the established tunnel to the bridge. The bridge then opens a local TCP connection to the target service.

Setup in Three Steps

Getting Bridge running takes about five minutes with the existing network, certificates, and firewall rules left unchanged.

1. 1

   Generate a Bridge Token

   Navigate to Project Settings > Bridge in the Connic dashboard and click Set Up Bridge. Copy the token that appears. It starts with cbr_ and is only shown once.

   

2. 2

   Deploy the Bridge Agent

   Run the bridge inside the private network. It needs outbound internet access to connect to the relay and local network access to reach the services.

   Docker

   Copy

   $ docker run -d --name connic-bridge \
     -e BRIDGE_TOKEN=cbr_your_token_here \
     -e ALLOWED_HOSTS=kafka:9092,postgres:5432 \
     connicorg/bridge:latest

   The ALLOWED_HOSTS variable is an optional comma-separated list of host:port pairs. When configured, requests targeting hosts outside the list are rejected. If it is unset or empty, the bridge can connect to every target reachable from its network.

   Prefer Docker Compose? That works too:

   docker-compose.yml

   Copy

   services:
     connic-bridge:
       image: connicorg/bridge:latest
       restart: always
       environment:
         BRIDGE_TOKEN: cbr_your_token_here
         ALLOWED_HOSTS: kafka:9092,postgres:5432,my-db:5432

3. 3

   Enable Bridge on the Connectors

   When creating or editing a connector, open the Network Access section and choose the bridge from the Bridge dropdown. Connic then routes that connector's traffic through the bridge tunnel instead of connecting directly. The pre-built connectors guide explains the connector layer before Bridge is added.

   

   Bridge access is supported on:

   Apache Kafka (inbound + outbound)

   AWS SQS (inbound + outbound)

   PostgreSQL (LISTEN/NOTIFY)

   Email / IMAP / SMTP

   AWS S3 (file downloads)

   HTTP Webhook (outbound)

Security by Design

The bridge was designed with a zero-trust mindset. Every layer limits what's possible:

Real-World Use Cases

A few patterns we see teams building with Bridge:

Bridge vs. Alternatives

Monitoring a Bridge

Once deployed, bridge status is available at any time in Project Settings > Bridge. The dashboard shows whether the bridge is connected and when it last connected, with controls to regenerate or revoke the token.

Getting Started

For private infrastructure, Bridge provides a direct connection to AI agents:

1. 1

   Open the project in the Connic dashboard and go to Settings > Bridge

2. 2

   Generate a token and deploy the bridge container in the private network

3. 3

   Enable Connect via Bridge on any connector that targets a private service

4. 4

   The agents can now consume events from and deliver results to private infrastructure

The Bridge documentation provides the full configuration reference and troubleshooting guide. For a new Connic project, the quickstart guide covers the first agent deployment before it is connected to private infrastructure.