SSH tunnel

Prerequisites

• A server (e.g. EC2 instance or Azure VM) that can reach your database over the private network
• SSH access to that server (port 22 open from Artie’s IP range)
• Your database must be reachable from the SSH tunnel host

How to set up an SSH tunnel

1. Create a tunnel host

   Create a new EC2 instance (or equivalent) that has network access to your database. Record the public IP address and SSH port (default: 22).

2. Create an SSH tunnel in Artie

   Go to Settings > SSH tunnels and click New SSH tunnel. Enter a Name, the host’s public IP or hostname as SSH host, the SSH port, and artie as the SSH username (you’ll create this user in step 4). Click Save.

3. Copy the public key

   After saving, Artie generates a public key for the tunnel. Copy this key, you will add it to your tunnel host in the next step.

   

4. Add the public key to your tunnel host

   SSH into your tunnel host and add the public key to ~/.ssh/authorized_keys. We recommend creating a dedicated service account for Artie.

   BashCopyCopied

   sudo useradd -m -s /bin/bash artie
   sudo su artie
   mkdir -p ~/.ssh
   
   # Paste the public key from Artie into authorized_keys
   vi ~/.ssh/authorized_keys
   
   chmod 700 ~/.ssh
   chmod 600 ~/.ssh/authorized_keys

5. Use the tunnel in your pipeline

   When creating or editing a source or destination, select the SSH tunnel you created from the SSH tunnel dropdown.

FAQ

Can I use an existing bastion host?

Yes. You don’t need to create a new instance. Any server that can reach your database and accepts SSH connections will work. Add the Artie public key to the authorized_keys file on that host.

Which port does Artie connect on?

Artie connects to the SSH tunnel host on the port you specify during setup (default: 22). The tunnel then forwards traffic to your database on its private port.

How do I rotate the SSH key?

Create a new SSH tunnel in Artie to get a new key pair. Use the same environment, host, port and username as the old one, or pick New SSH tunnel in the connector’s tunnel dropdown. Add its public key to ~/.ssh/authorized_keys on your tunnel host, switch your connectors to the new tunnel, and deploy the pipelines that use them. Pipelines keep the old key until they’re deployed. Then remove the old public key from the host and delete the old tunnel. Artie doesn’t let you delete a tunnel while a connector still uses it.

Can I use SSH tunnels with PrivateLink?

SSH tunnels and PrivateLink are separate connection methods. You typically only need one. If your database is in AWS and you want a fully private connection without managing an SSH host, consider PrivateLink instead.