docs(wiki): document Unix socket connections (local and via SSH forward)

content/wiki/connections.md

@@ -46,6 +46,7 @@ When creating a connection (`+` button in the sidebar or `Cmd/Ctrl + Shift + N`)
 | **Driver** | Yes | Selects the database type |
 | **Host** | Yes* | Hostname or IP address |
 | **Port** | Yes* | Auto-filled from the driver default |
+| **Socket path** | No | Unix socket the database listens on at the connection's destination, replacing Host and Port. Dialed directly on this machine without a tunnel (MySQL/PostgreSQL); with SSH, the SSH server connects to it. Disables database TLS. Ignored with Kubernetes. See [Connecting over a Unix socket](#connecting-over-a-unix-socket) below. |
 | **Database** | Yes* | The database name to connect to |
 | **Username** | Yes* | Database user |
 | **Password** | No | Stored in OS keychain; never written to disk |
@@ -95,6 +96,18 @@ SELECT set_config('app.bypass_rls', 'on', false);
 
 applies to every subsequent query instead of randomly depending on which pooled connection you landed on. Any `SET` or session-setup statement works; multiple statements can be separated normally, and blank or whitespace-only scripts are skipped. The script is stored with the connection profile as non-secret configuration.
 
+### Connecting over a Unix socket
+
+The optional **Socket Path** field in the General tab names the Unix socket the database listens on, replacing Host and Port. Like Host and Port, it is interpreted from the perspective of whoever dials the destination:
+
+- **No tunnel** — the drivers connect to the socket on this machine directly (MySQL and PostgreSQL). Typical values: `/tmp/mysql.sock` (MySQL on macOS/Homebrew), `/var/run/mysqld/mysqld.sock` (MySQL on Linux), `/var/run/postgresql/.s.PGSQL.5432` (PostgreSQL). For PostgreSQL, a plain socket *directory* also works, paired with the Port field.
+- **SSH tunnel** — the SSH server connects to the socket, so the path is as it appears on that server. See [SSH Tunneling → Forwarding to a Unix Socket](/wiki/ssh-tunneling#forwarding-to-a-unix-socket).
+- **Kubernetes tunnel** — the field is ignored (`kubectl port-forward` is TCP-only).
+
+While a socket path is in effect, Host and Port grey out, and database TLS is turned off automatically — it cannot be negotiated over a Unix socket, and the traffic is either local or already encrypted by the SSH tunnel.
+
+Without a tunnel the field appears for drivers that support local socket dialing (built-in MySQL and PostgreSQL; plugins opt in with the `unix_socket` capability, see [Plugins → Capabilities](/wiki/plugins#capabilities)). With SSH enabled it is available for any network driver, since the drivers still connect over TCP to the tunnel's local port.
+
 ### SQLite
 
 For SQLite, provide the absolute path to the `.db` or `.sqlite` file using the file picker. There is no host, port, or authentication.

content/wiki/plugins.md

@@ -92,6 +92,7 @@ Every plugin must include a `manifest.json` that tells Tabularis its capabilitie
 | `connection_string_example` | string | Optional placeholder example shown in the connection string import field (e.g. `"clickhouse://user:pass@localhost:9000/db"`). `connectionStringExample` is also accepted. |
 | `manage_tables` | bool | `true` to enable table and column management UI (Create Table, Add/Modify/Drop Column, Drop Table). Does not control index or FK operations. Defaults to `true`. |
 | `readonly` | bool | When `true`, the driver is read-only: all data modification operations (INSERT, UPDATE, DELETE) are disabled in the UI. Table and column management is also hidden regardless of `manage_tables`. Defaults to `false`. |
+| `unix_socket` | bool | `true` if the driver can dial a local Unix socket instead of host:port. Shows the **Socket Path** field in the connection editor even without an SSH tunnel (with SSH enabled the field appears for every network driver, since the tunnel does the socket dialing); the path reaches the plugin in the connection params as `unix_socket_path`. `unixSocket` is also accepted. Defaults to `false`. |
 
 ### Data Type Categories
 

content/wiki/ssh-tunneling.md

@@ -92,6 +92,18 @@ Click **Test** before saving. Tabularis performs a real SSH handshake and report
 
 When you connect, the tunnel is established first, then the database driver connects through it. If the tunnel fails, the exact SSH error is surfaced — no generic "connection refused" messages.
 
+## Forwarding to a Unix Socket
+
+Some databases only listen on a Unix socket: MySQL with `skip_networking`, PostgreSQL with `listen_addresses = ''`. For those, set the connection's optional **Socket Path** field (General tab). Like Host and Port, the field names the destination from the perspective of whoever dials it: with the SSH tunnel enabled that is the SSH server, so the path is as it appears there. (For a socket-only database on *your own* machine, no tunnel is needed — the same field dials the socket locally; see [Connections → Connecting over a Unix socket](/wiki/connections#connecting-over-a-unix-socket).)
+
+When a socket path is set:
+
+- The SSH server connects to that socket instead of Host and Port (both fields grey out). Under the hood this is a `direct-streamlocal@openssh.com` channel on the Russh backend, and `ssh -L <local_port>:/path/to/socket` on the System SSH backend.
+- Database TLS is turned off automatically. A server listening on a Unix socket cannot negotiate TLS, and the SSH tunnel already encrypts the whole path.
+- The path must be absolute, as it appears on the SSH server, and must point at the socket file itself — not the directory holding it. Typical values are `/var/run/mysqld/mysqld.sock` (MySQL) and `/var/run/postgresql/.s.PGSQL.5432` (PostgreSQL).
+
+The socket path belongs to the database connection, not to the SSH profile, so a single bastion profile can serve both TCP and socket-only databases.
+
 ## Multi-Hop / ProxyJump
 
 For databases behind multiple bastion layers, define the chain in `~/.ssh/config` and use the System SSH backend (key-only auth, no password):