feat(connections): Unix socket support — dialed locally or through the SSH tunnel#492
Open
debba wants to merge 5 commits into
Open
feat(connections): Unix socket support — dialed locally or through the SSH tunnel#492debba wants to merge 5 commits into
debba wants to merge 5 commits into
Conversation
Add unix_socket_path to ConnectionParams: when set and no SSH/K8s tunnel is enabled, MySQL connects via sqlx's socket option and PostgreSQL via host_path (the .s.PGSQL.<port> file path is split into directory + port). Database TLS is forced off — a local socket peer cannot negotiate it and the traffic never leaves the machine. Tunnel resolution clears the field so a leftover path cannot bypass the tunnel's forwarded port. The field is gated by a new unix_socket driver capability (default false, true for the built-in mysql/postgres drivers); plugins can opt in via their manifest. The connection modal shows a Local Socket Path field that greys out Host/Port when active, reusing the SSH-forward advisory checks (helper renamed to unixSocketPathIssue).
debba
changed the title
debba
added a commit
to TabularisDB/website
that referenced
this pull request
Jul 18, 2026
Companion to TabularisDB/tabularis#492: the PR now also lets the MySQL and PostgreSQL drivers dial a Unix socket on the local machine directly, gated by the new unix_socket driver capability. Adds the field to the connection-profile table, a Local Unix socket section in connections.md, the capability row in plugins.md, and a cross-link from the SSH forwarding section.
Contributor
Code Review SummaryStatus: No Issues Found | Recommendation: Merge Files Reviewed (25 files)
Previous Review Summary (commit 4b2f54f)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 4b2f54f)Status: No Issues Found | Recommendation: Merge Files Reviewed (25 files)
Reviewed by kimi-k2.6 · Input: 58.2K · Output: 3.8K · Cached: 34.4K |
The SSH-forward socket path and the local socket path were the same concept — the Unix socket the database listens on at the connection's destination — distinguished only by who dials it. Host/port already have exactly that tunnel-relative semantics, so fold both into the single unix_socket_path field: without a tunnel the drivers dial it locally (capability-gated), with SSH it becomes the forward destination, and a K8s tunnel ignores it. ssh_forward_unix_socket_path is gone (never shipped, so nothing saved references it). One Socket Path field now lives in the General tab, shown when the driver has the unix_socket capability or SSH is enabled, with hints that follow the tunnel state; the SSH-tab field is removed and the i18n keys collapse from 11 to 8 per locale.
debba
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
A single optional Socket Path field on the connection: the Unix socket the database listens on at the connection's destination. Like Host and Port, its perspective follows the tunnel state:
direct-streamlocal@openssh.comchannel (russh backend) orssh -L <port>:/path/to/socket(system ssh backend). Reaches databases that only listen on a socket, e.g. MySQL withskip_networkingor PostgreSQL withlisten_addresses = ''.kubectl port-forwardis TCP-only).How
unix_socket_pathparam onConnectionParamsdrives both modes.resolve_connection_paramsturns it into theSshForwardDestination::UnixSocketwhen SSH is enabled (enum threaded throughSshTunnel::new, both backends, and the tunnel cache key); tunnel resolution then clears the field so it can never bypass the tunnel's forwarded local port at the driver level..socket(); PostgreSQL viaConfig::host_path— the socket file (/var/run/postgresql/.s.PGSQL.5432) is split into the directory + port tokio_postgres expects, and a plain directory also works, paired with the Port field. The ad-hoc pool cache key uses the socket as the endpoint in place of host:port.unix_socketdriver capability (defaultfalse;truefor built-in mysql/postgres; plugins opt in via manifest,unixSocketalias accepted). The field shows in the General tab when the driver has the capability or SSH is enabled; Host/Port grey out while a socket is in effect, and advisory hints (never blocking) follow the tunnel state and flag relative or directory-looking paths.Plugin drivers are untouched: with SSH they receive already-resolved params (127.0.0.1 + local tunnel port); the field is skip-serialized when unset, so JSON-RPC payloads only change when the feature is used.
Tests
cargo test: 962 passed (forward-spec/tunnel-key destination tests, resolve-side destination + ssl override tests, local-socket option builders, postgres socket-path splitting, pool-key endpoint tests, tunnel-clears-socket test)pnpm test: 2929 passed (unixSocketPathIssue,effectiveLocalSocketPath, socket-aware format/validate/subtitle)tsc --noEmitandeslintclean