feat: add SSH tunnel support for database connections (#67)

Enable backups and restores for databases behind firewalls via SSH
tunneling (bastion/jump server). The system establishes an SSH tunnel
before database operations and routes traffic through it.

- Add SshTunnelService for tunnel lifecycle management
- Support password and private key authentication
- Integrate tunneling into BackupTask, RestoreTask, and connection testing
- Add UI for SSH configuration with independent connection test
- Encrypt sensitive fields (password, private_key, passphrase) at rest
- Mask SSH secrets in logs

Author: David Courtey

.env

@@ -127,6 +127,9 @@ OAUTH_OIDC_LABEL=SSO
 # Enable failure notifications for backup/restore jobs (default: false)
 NOTIFICATION_ENABLED=false
 
+# Notification channels (comma-separated): mail, slack, discord
+NOTIFICATION_CHANNELS=mail
+
 # Email recipient for failure notifications
 NOTIFICATION_MAIL_TO=
 

.env.mysql.testing

@@ -49,35 +49,17 @@ create-bucket: ## Create S3 bucket in rustfs (usage: make create-bucket BUCKET=m
 test: ## Run all tests in parallel (default)
 	$(PHP_ARTISAN) test --parallel
 
-test-sequential: ## Run all tests sequentially (for debugging)
-	$(PHP_ARTISAN) test
-
-test-mysql: ## Run all tests with MySQL
-	$(DOCKER_COMPOSE) exec -T mysql mysql -uroot -proot -e "DROP DATABASE IF EXISTS databasement_app_test; CREATE DATABASE databasement_app_test;" 2>/dev/null || true
-	$(DOCKER_COMPOSE) exec -T -e EXTRA_ENV_FILE=.env.mysql.testing $(PHP_SERVICE) php artisan test
-
 test-filter: ## Run tests with filter (usage: make test-filter FILTER=DatabaseServer)
-	$(PHP_ARTISAN) test --filter="$(FILTER)"
-
-test-filter-mysql: ## Run tests with filter using MySQL (usage: make test-filter-mysql FILTER=DatabaseServer)
-	$(DOCKER_COMPOSE) exec -T mysql mysql -uroot -proot -e "CREATE DATABASE IF NOT EXISTS databasement_app_test;" 2>/dev/null || true
-	$(DOCKER_COMPOSE) exec -T -e EXTRA_ENV_FILE=.env.mysql.testing $(PHP_SERVICE) php artisan test --filter="$(FILTER)"
-
-test-postgres: ## Run all tests with PostgreSQL
-	$(DOCKER_COMPOSE) exec -T postgres psql -U root -d postgres -c "DROP DATABASE IF EXISTS databasement_app_test;"
-	$(DOCKER_COMPOSE) exec -T postgres psql -U root -d postgres -c "CREATE DATABASE databasement_app_test;"
-	$(DOCKER_COMPOSE) exec -T -e EXTRA_ENV_FILE=.env.postgres.testing $(PHP_SERVICE) php artisan test
-
-test-filter-postgres: ## Run tests with filter using PostgreSQL (usage: make test-filter-postgres FILTER=DatabaseServer)
-	$(DOCKER_COMPOSE) exec -T postgres psql -U root -d postgres -c "DROP DATABASE IF EXISTS databasement_app_test;"
-	$(DOCKER_COMPOSE) exec -T postgres psql -U root -d postgres -c "CREATE DATABASE databasement_app_test;"
-	$(DOCKER_COMPOSE) exec -T -e EXTRA_ENV_FILE=.env.postgres.testing $(PHP_SERVICE) php artisan test --filter="$(FILTER)"
+	$(PHP_ARTISAN) test --parallel  --filter="$(FILTER)"
 
 test-coverage: ## Run tests with coverage
-	$(PHP_ARTISAN) test --coverage
+	$(PHP_ARTISAN) test --parallel --coverage
 
 test-coverage-filter: ## Run tests with coverage and filter (usage: make test-coverage-filter FILTER=FailureNotification)
-	$(PHP_EXEC) php -d xdebug.mode=coverage ./vendor/bin/pest --filter="$(FILTER)" --coverage
+	$(PHP_ARTISAN) test --parallel --coverage --filter="$(FILTER)"
+
+test-sequential: ## Run all tests sequentially (for debugging)
+	$(PHP_ARTISAN) test
 
 ##@ Code Quality
 

.env.postgres.testing

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Exceptions;
+
+use RuntimeException;
+
+class SshTunnelException extends RuntimeException
+{
+    public function __construct(
+        string $message,
+        int $code = 0,
+        ?\Throwable $previous = null,
+        public readonly ?string $sshErrorOutput = null
+    ) {
+        parent::__construct($message, $code, $previous);
+    }
+}

Makefile

@@ -5,7 +5,7 @@
 use Illuminate\Support\Facades\Facade;
 
 /**
- * @method static array<string, mixed> test(array<string, mixed> $config)
+ * @method static array<string, mixed> test(array<string, mixed> $config, \App\Models\DatabaseServerSshConfig|null $sshConfig = null)
  *
  * @see \App\Services\DatabaseConnectionTester
  */

app/Exceptions/SshTunnelException.php

@@ -43,6 +43,11 @@ public function testConnection(): void
         $this->form->testConnection();
     }
 
+    public function testSshConnection(): void
+    {
+        $this->form->testSshConnection();
+    }
+
     public function refreshVolumes(): void
     {
         $this->success(__('Volume list refreshed.'), position: 'toast-bottom');

app/Facades/DatabaseConnectionTester.php

@@ -45,11 +45,23 @@ public function testConnection(): void
         $this->form->testConnection();
     }
 
+    public function testSshConnection(): void
+    {
+        $this->form->testSshConnection();
+    }
+
     public function refreshVolumes(): void
     {
         $this->success(__('Volume list refreshed.'), position: 'toast-bottom');
     }
 
+    public function loadDatabases(): void
+    {
+        if (! $this->form->isSqlite()) {
+            $this->form->loadAvailableDatabases();
+        }
+    }
+
     public function render(): View
     {
         return view('livewire.database-server.edit')

app/Livewire/DatabaseServer/Create.php

@@ -61,8 +61,7 @@ public function clear(): void
     public function headers(): array
     {
         return [
-            ['key' => 'name', 'label' => __('Name'), 'class' => 'w-64'],
-            ['key' => 'host', 'label' => __('Connection'), 'class' => 'w-48'],
+            ['key' => 'name', 'label' => __('Name'), 'class' => 'w-80'],
             ['key' => 'database_names', 'label' => __('Databases'), 'sortable' => false],
             ['key' => 'backup', 'label' => __('Backup'), 'sortable' => false],
             ['key' => 'jobs', 'label' => __('Jobs'), 'sortable' => false, 'class' => 'w-32'],