From ef3ee8ea4da59f97cfaa123fa0f62b751cd178e7 Mon Sep 17 00:00:00 2001 From: Noah Stride Date: Mon, 29 Apr 2024 20:05:00 +0100 Subject: [PATCH] Add `database-tunnel` service to Machine ID reference (#40993) * Add `database-tunnel` service to Machine ID reference * Update docs/pages/machine-id/reference/configuration.mdx Co-authored-by: Paul Gottschling --------- Co-authored-by: Paul Gottschling --- .../machine-id/reference/configuration.mdx | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/docs/pages/machine-id/reference/configuration.mdx b/docs/pages/machine-id/reference/configuration.mdx index b7fbe5004fc..e292d0ab595 100644 --- a/docs/pages/machine-id/reference/configuration.mdx +++ b/docs/pages/machine-id/reference/configuration.mdx @@ -389,6 +389,38 @@ svids: - 10.0.0.1 ``` +#### `database-tunnel` + +The `database-tunnel` service opens a listener for a service that tunnels +connections to a database server. + +The tunnel authenticates connections for the client, meaning that any +application which can connect to the listener will be able to connect to the +database as the specified user. For this reason, we heavily recommend using the +Unix socket listener type and configuring the permissions of the socket to +ensure that only the intended applications can connect. + +```yaml +# type specifies the type of the service. For the database tunnel service, this +# will always be `database-tunnel`. +type: database-tunnel +# listen specifies the address that the service should listen on. +# +# Two types of listener are supported: +# - TCP: `tcp://
:` +# - Unix socket: `unix:///` +listen: tcp://127.0.0.1:25432 +# service is the name of the database server, as configured in Teleport, that +# the service should open a tunnel to. +service: postgres-docker +# database is the name of the specific database on the specified database +# service. +database: postgres +# username is the name of the user on the specified database server to open a +# tunnel for. +username: postgres +``` + ### Destinations A destination is somewhere that `tbot` can read and write artifacts.