Connecting via SSH Tunnel
For targets reachable only inside a private network, a connection can be forwarded through an SSH bastion. The tunnel is opt-in per connection and dialect-agnostic, the database driver dials a local forwarder as though the target were on localhost.
Configuration
In the connection editor's SSH Tunnel tab, enable the tunnel and provide:
- SSH Host / Port, the bastion address (default 22).
- SSH Username.
- Bastion host key fingerprint (SHA256), mandatory. The bastion is verified against this pin on every connect; there is no trust-on-first-use and no "accept any host" escape hatch. Capture it with
ssh-keyscan -p PORT HOST | ssh-keygen -lf -. - Auth, password, or a PEM private key with optional passphrase.
On Basic Configuration, set Host/Port to the database address as resolved from the bastion (commonly 127.0.0.1 or a private hostname).
Security
Host-key verification runs on every connection, a missing or mismatched fingerprint fails loud rather than degrading to an unverified session. The SSH password, private key, and passphrase are encrypted at rest with AES-256-GCM exactly like database passwords, and masked in API responses. As with all stored secrets, this protection is only real when ENCRYPTION_KEY is set (see Environment Variables).