Add SSH tunnel for Postgres connections

[pavi2410]

Summary

• Add a one-hop SSH tunnel (bastion) so Postgres can reach private hosts via russh, with key file or ssh-agent and strict ~/.ssh/known_hosts.
• Persist an optional [ssh] table on connection files and expose the same fields in the Postgres wizard.
• Keep saved host/port as the address seen from the bastion; rewrite to 127.0.0.1 only at connect/test time.

Test plan

• Create a Postgres connection with SSH tunnel on: bastion host/user, optional key path (empty → agent), Test then Connect.
• Confirm ~/.ssh/known_hosts is required (unknown host fails with an SSH error, not “cannot reach database”).
• Save the connection; reopen the file and confirm [ssh] is written and secrets stay in .env.
• Edit SSH fields on a live connection and confirm it reconnects.
• Verify CA / Verify Full through SSH is rejected with the hostname-verify message; Require still works.

Made with Cursor

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	based	357bdca	Commit Preview URL Branch Preview URL	Aug 19 2026, 05:46 AM