--- title: How Rinsed builds data pipelines in car washes: the... description: Rinsed, a CRM platform for the car wash industry, shares engineering lessons from building data pipelines across hundreds of sites running ancient Windows... canonical: https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How Rinsed builds data pipelines in car washes: the lessons learned | daily.dev og:description: Rinsed, a CRM platform for the car wash industry, shares engineering lessons from building data pipelines across hundreds of sites running ancient Windows... og:url: https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb og:image: https://api.daily.dev/og/posts/WEOpoO7wb.png og:image:alt: How Rinsed builds data pipelines in car washes: the lessons learned og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Rinsed builds data pipelines in car washes: the lessons learned **[ngrok Blog](https://daily.dev/sources/ngrok)** · 8 min read · 0 upvotes · 0 comments ## Summary Rinsed, a CRM platform for the car wash industry, shares engineering lessons from building data pipelines across hundreds of sites running ancient Windows machines, tangled firewall setups, and non-technical operators. The team describes progressively degrading their deployment scripts down to old Bash instead of PowerShell, hiding networking complexity behind ngrok's reverse tunnels and TLS endpoints, and reframing security around visible, human-understandable restrictions (outbound-only tunnels, VPC IP allowlists, separate admin tools, employee VPNs) to address customer fear even when the underlying tech was already secure. Technically, they connect to legacy Firebird databases over port 3050 using the ngrok CLI agent with TLS endpoints and IP policies, and migrated from NSSM to ngrok's native service subcommand for running the agent as a Windows service. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I remotely access a legacy Firebird database running on an old Windows machine behind multiple layers of NAT and firewalls? Install the ngrok CLI agent with a YAML config on the machine to create an outbound-only TLS endpoint pointing at the database's port, commonly 3050 for Firebird. The terminate-tls traffic policy action ends TLS at ngrok's network before forwarding traffic through the tunnel, and IP policies restrict access to specific static IPs belonging to a trusted VPC. _daily.dev surfaces practical patterns like this for engineers wiring up secure access to legacy on-prem systems._ ### How do you run the ngrok agent as a persistent Windows service that survives reboots and reconnects after network drops? Use the built-in ngrok service subcommand instead of third-party tools like the Non-Sucking Service Manager. Running ngrok service install --config="/path/to/ngrok.yaml" followed by ngrok service start sets up the agent to start a TLS endpoint on boot and automatically reconnect the tunnel after any network interruption. _engineers standardizing agent deployment across flaky remote sites can track tooling changes like this on daily.dev._ ### Why would a company choose reverse tunnels over teaching customers port forwarding for remote data access? Because non-technical customers often can't grasp port forwarding even after explanation, making it a support burden rather than a solvable education problem. Reverse, outbound-only tunnels abstract the networking entirely so the connection just works without requiring firewall changes, port knowledge, or trust in inbound access from the customer's side. _daily.dev helps developers weighing tunneling versus traditional networking approaches for remote deployments stay informed._ ## Similar posts on daily.dev - [I Built My Second ETL Pipeline. This Time, I Started Thinking Like a Data Engineer](https://daily.dev/posts/i-built-my-second-etl-pipeline-this-time-i-started-thinking-like-a-data-engineer-3mf1pyvke) · Towards Data Science · 7 upvotes · 0 comments - [Data-to-Production: Bridging the Gap Between Iceberg and Live Microservices](https://daily.dev/posts/data-to-production-bridging-the-gap-between-iceberg-and-live-microservices-kda4jldun) · Wix Engineering · 3 upvotes · 0 comments - [Why Building a Production RAG Pipeline is Easier Than You Think](https://daily.dev/posts/why-building-a-production-rag-pipeline-is-easier-than-you-think-x6vszqrzs) · Planet Python · 4 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-pdhcjppw4) · Medium · 0 upvotes · 0 comments --- Tags: [#devops](https://daily.dev/tags/devops), [#devtools](https://daily.dev/tags/devtools), [#networking](https://daily.dev/tags/networking) [View this post on daily.dev](https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How Rinsed builds data pipelines in car washes: the lessons learned","url":"https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb"},"datePublished":"2026-08-23T07:21:08.911Z","dateModified":"2026-08-23T07:28:05.745Z","description":"Rinsed, a CRM platform for the car wash industry, shares engineering lessons from building data pipelines across hundreds of sites running ancient Windows...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e18f239c4024b0dc105b0b1dd286d17d?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/e18f239c4024b0dc105b0b1dd286d17d?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"ngrok Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"ngrok Blog","logo":"https://media.daily.dev/image/upload/s--718XXxvE--/f_auto,q_auto/v1787469610/logos/ngrok?_a=BAMAMicg0","url":"https://daily.dev/sources/ngrok"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"devops,devtools,networking","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"ngrok Blog","item":"https://daily.dev/sources/ngrok"},{"@type":"ListItem","position":3,"name":"How Rinsed builds data pipelines in car washes: the lessons learned"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-rinsed-builds-data-pipelines-in-car-washes-the-lessons-learned-weopoo7wb#faq","mainEntity":[{"@type":"Question","name":"How can I remotely access a legacy Firebird database running on an old Windows machine behind multiple layers of NAT and firewalls?","acceptedAnswer":{"@type":"Answer","text":"Install the ngrok CLI agent with a YAML config on the machine to create an outbound-only TLS endpoint pointing at the database's port, commonly 3050 for Firebird. The terminate-tls traffic policy action ends TLS at ngrok's network before forwarding traffic through the tunnel, and IP policies restrict access to specific static IPs belonging to a trusted VPC. daily.dev surfaces practical patterns like this for engineers wiring up secure access to legacy on-prem systems."}},{"@type":"Question","name":"How do you run the ngrok agent as a persistent Windows service that survives reboots and reconnects after network drops?","acceptedAnswer":{"@type":"Answer","text":"Use the built-in ngrok service subcommand instead of third-party tools like the Non-Sucking Service Manager. Running ngrok service install --config=\"/path/to/ngrok.yaml\" followed by ngrok service start sets up the agent to start a TLS endpoint on boot and automatically reconnect the tunnel after any network interruption. engineers standardizing agent deployment across flaky remote sites can track tooling changes like this on daily.dev."}},{"@type":"Question","name":"Why would a company choose reverse tunnels over teaching customers port forwarding for remote data access?","acceptedAnswer":{"@type":"Answer","text":"Because non-technical customers often can't grasp port forwarding even after explanation, making it a support burden rather than a solvable education problem. Reverse, outbound-only tunnels abstract the networking entirely so the connection just works without requiring firewall changes, port knowledge, or trust in inbound access from the customer's side. daily.dev helps developers weighing tunneling versus traditional networking approaches for remote deployments stay informed."}}]} ```