Network Handlers Reference

Table of contents

• SSH tunnel
• SSL
  • Common properties
• Kubernetes
• AWS SSM
• SOCKS proxy

The handlers object inside a connection's configuration routes the connection through a network handler. Each handler is keyed by its handler ID.

To see all available handlers for a specific driver, run:

dbvr network-handlers --driver=<driver-id>

All handlers share these top-level fields:

Field	Type	Default	Description
type	string	-	Handler type
			- TUNNEL (SSH tunnel, Kubernetes, AWS SSM)
			- CONFIG (SSL)
			- PROXY (SOCKS proxy)
enabled	boolean	false	Enable this handler for the connection
save-password	boolean	false	Store credentials in the workspace config. When true, the encrypted credentials file is used. When false, credentials must be entered on each connect
properties	object	-	Handler-specific parameters. See sections below

SSH tunnel

Handler ID: ssh_tunnel, type: TUNNEL

Note: SSH target credentials are stored separately from the connection settings in data-sources.json.

Property	Type	Default	Description
host	string	-	SSH server hostname or IP
port	integer	22	SSH server port
authType	string	-	Auth method: PASSWORD, PUBLIC_KEY, or AGENT
keyPath	string	-	Path to the private key file. Used when authType is PUBLIC_KEY
implementation	string	jsch	SSH library: jsch or sshj
bypassHostVerification	boolean	false	Skip SSH host key verification
shareTunnels	boolean	false	Reuse a single SSH tunnel across multiple connections to the same host
localHost	string	-	Local host for port forwarding
localPort	integer	-	Local port for port forwarding
remoteHost	string	-	Remote host to forward traffic to
remotePort	integer	-	Remote port to forward traffic to
aliveInterval	integer	-	Keep-alive interval in milliseconds
sshConnectTimeout	integer	-	Tunnel connection timeout in milliseconds

Jump servers use indexed properties:

Property	Type	Description
jumpServer.count	integer	Number of jump servers in the chain
jumpServerN.host	string	Hostname of jump server N (0-based index)
jumpServerN.port	integer	Port of jump server N
jumpServerN.name	string	Username for jump server N
jumpServerN.authType	string	Auth method for jump server N: PASSWORD, PUBLIC_KEY, or AGENT
jumpServerN.enabled	boolean	Enable this jump server

Example:

{
  "handlers": {
    "ssh_tunnel": {
      "type": "TUNNEL",
      "enabled": true,
      "save-password": true,
      "properties": {
        "jumpServer.count": 1,
        "jumpServer0.host": "jump.example.com",
        "jumpServer0.port": 22,
        "jumpServer0.name": "jumpuser",
        "jumpServer0.authType": "PASSWORD",
        "jumpServer0.enabled": true,
        "host": "db.internal.example.com",
        "port": 22,
        "authType": "PUBLIC_KEY",
        "keyPath": "${project.path}/Keys/id_rsa"
      }
    }
  }
}

SSL

Type: CONFIG. Each database driver uses its own SSL handler ID (e.g. postgre_ssl, mysql_ssl, mongo_ssl). To find the correct ID for your driver, run dbvr network-handlers --driver=<driver-id>.

Common properties

Most SSL handlers support certificates-based auth:

Property	Type	Default	Description
ssl.method	string	CERTIFICATES	Auth method: CERTIFICATES or KEYSTORE
ssl.sslMode	string		Set the SSL connection mode. Use disable, allow, prefer, require, verify-ca, or verify-full
ssl.ca.cert	string		Path to the CA certificate file
ssl.ca.cert.value	string		CA certificate content (inline)
ssl.client.cert	string		Path to the client certificate file
ssl.client.cert.value	string		Client certificate content (inline)
ssl.client.key	string		Path to the client private key file
ssl.client.key.value	string		Client private key content (inline)

For keystore-based auth (ssl.method: KEYSTORE):

Property	Type	Description
ssl.keystore	string	Path to the keystore file
ssl.keystore.value	string	Keystore content (inline)
ssl.keystore.password	string	Keystore password

Example:

{
  "handlers": {
    "postgre_ssl": {
      "type": "CONFIG",
      "enabled": true,
      "save-password": true,
      "properties": {
        "ssl.method": "CERTIFICATES",
        "ssl.sslMode": "verify-full",
        "ssl.ca.cert": "${project.path}/Keys/ca.crt",
        "ssl.client.cert": "${project.path}/Keys/client.crt",
        "ssl.client.key": "${project.path}/Keys/client.key"
      }
    }
  }
}

Kubernetes

Handler ID: k8s_proxy, type: TUNNEL.

Property	Type	Default	Description
config	string	-	Path to the kubeconfig file
context	string	default	Kubernetes context to use
namespace	string	default	Namespace of the target pod or service
resource	string	-	Pod or service name to forward to
remotePort	string	-	Port on the target pod or service

Example:

{
  "handlers": {
    "k8s_proxy": {
      "type": "TUNNEL",
      "enabled": true,
      "save-password": true,
      "properties": {
        "config": "~/.kube/config",
        "context": "prod",
        "namespace": "databases",
        "resource": "postgres-0",
        "remotePort": "5432"
      }
    }
  }
}

AWS SSM

Handler ID: aws_ssm, type: TUNNEL. Forwards the database port through an EC2 instance using AWS Systems Manager Session Manager - no open inbound ports or bastion host required.

Property	Type	Description
ssm.instance.id	string	EC2 instance ID
ssm.instance.region	string	AWS region of the instance
ssm.document	string	SSM document name for port forwarding
ssm.debug	boolean	Enable SSM debug logging
iam.use_default_aws	boolean	Use the default AWS credential chain instead of explicit keys
iam.profile_name	string	AWS profile name
iam.aws_access_key	string	AWS access key ID
iam.aws_secret_key	string	AWS secret access key
iam.aws_session_token	string	Session token for temporary credentials

Example:

{
  "handlers": {
    "aws_ssm": {
      "type": "TUNNEL",
      "enabled": true,
      "save-password": true,
      "properties": {
        "ssm.instance.id": "i-0abc123def456",
        "ssm.instance.region": "us-east-1",
        "iam.use_default_aws": true
      }
    }
  }
}

SOCKS proxy

Handler ID: dynamic_proxy, type: PROXY.

Property	Type	Default	Description
socks-host	string	-	SOCKS proxy hostname
socks-port	integer	-	SOCKS proxy port
pac_enabled	boolean	false	Enable automatic proxy detection
pac_strategy_os	boolean	false	Use the proxy settings from operating system
pac_strategy_browser	boolean	false	Use the web browser proxy settings
pac_strategy_env	boolean	false	Use the proxy settings from environment variables

Example:

{
  "handlers": {
    "dynamic_proxy": {
      "type": "PROXY",
      "enabled": true,
      "save-password": true,
      "properties": {
       "socks-host": "proxy.example.com",
        "socks-port": 1080
      }
    }
  }
}