Connect to databases through an SSH jump host - #7
Open
igor-alexandrov wants to merge 2 commits into
Open
igor-alexandrov wants to merge 2 commits into
igor-alexandrov wants to merge 2 commits into
Conversation
Profiles gain an `ssh` field ([user@]host[:port] or a ~/.ssh/config alias), set with `pgterm add --ssh`. Health checks hand the spec to pgbot via PGBOT_SSH_TUNNEL — it tunnels natively — and an ambient tunnel var is stripped when the profile has none, same rule as PGBOT_DATABASE_URL. The SQL and Data tabs ride an `ssh -W` child: its stdio is the connection (connect_raw), so no local port opens and the DSN keeps naming the real host — sslmode=verify-full and .pgpass keep working. Delegating to the user's own ssh keeps ssh_config, the agent, ProxyJump and known_hosts behaving exactly as `ssh bastion` does; BatchMode makes a refused login fail with its reason (folded into the error) instead of prompting into the TUI. Closes pgrundev#6 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Contributor
|
@igor-alexandrov thanks for the PR! WIP |
tokio-postgres only has Host::Unix on unix targets; on Windows a socket path parses as a Tcp "host", so the tunnel refusal never fired and ssh was spawned toward a path — the Windows CI test died on the resulting DNS error instead of the intended usage error. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Author
|
@alexshapalov fixed. Thanks for reviewing this! |
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #6.
Profiles get an
sshfield —[user@]host[:port]or a bare~/.ssh/configalias:How it works
Two paths, because pgterm has two ways of touching a database:
PGBOT_SSH_TUNNEL— it tunnels natively. An ambient tunnel var is stripped when the profile has none, so an exportedPGBOT_SSH_TUNNELcan't silently reroute every database (same rule the runner already applies toPGBOT_DATABASE_URL).ssh -Wchild process: its stdio is the connection (connect_raw), so no local port opens and the DSN keeps naming the real host —sslmode=verify-fulland.pgpasskeep working, same properties as pgbot's dialer.For pgterm's own leg I went with the system
sshrather than therusshport sketched in the issue. It keeps the dependency tree unchanged and getsssh_config, the agent, ProxyJump, hardware keys, ControlMaster and known_hosts behaving exactly like the user's ownssh bastion— the two pieces that would have needed hand-porting from pgbot (accept-new known_hosts,IdentitiesOnlyagent filtering) come for free. BatchMode means a refused login fails with its reason (folded into the tab's error) instead of prompting into a screen the TUI owns. The trade-off is an OpenSSH client requirement, which feels fair for a terminal tool;PGTERM_SSH_BINoverrides the binary.The spec is parsed and validated before it ever reaches argv — anything option-shaped (
-oProxyCommand=…) is refused ataddtime.Testing
SELECT 1over the tunneled stream against a real Postgres 17 (stdio bridge standing in forssh -W); also kept as an ignored live test (PGTERM_TEST_SSH_TUNNEL).cargo test(176 passed), clippy clean, fmt applied.The TUI add-popup doesn't collect the spec yet — config file and CLI only. Happy to add the field in a follow-up if wanted.
🤖 Generated with Claude Code