Hi all,
I'd like to propose a feature before writing any code, per the contributing guide.
Problem: pgAdmin supports SSH tunnels, but the tunnel is implemented in Python via sshtunnel rather than by invoking an external command. That means there is no way to use a ProxyCommand-style tunnel. The case I hit is AWS SSM Session Manager, where the tunnel is established by running 'aws ssm start-session', so pgAdmin cannot reach the database without a separate process running outside pgAdmin.
This is not AWS specific. The same limitation applies to GCP IAP tunnels, Kubernetes port-forward, and Azure Bastion. Similar requests exist for other database clients (JetBrains DBE-9500, Tabularis #765), so the need seems general.
Proposal: add an optional external tunnel command to the server connection config, alongside the existing SSH tunnel options. pgAdmin would spawn the command, connect to the resulting local port, and terminate the process when the connection closes. Users supply whatever command their environment needs, and pgAdmin stays cloud neutral.
This follows the same pattern as passexec, where pgAdmin shells out to a user-supplied command rather than implementing each backend itself.
Questions before I start:
1. Is this direction acceptable, or would you prefer discrete tunnel types (SSH, SSM, etc.) instead?
2. Are there security concerns with spawning a user-configured command that I should design around, particularly in server mode?
3. Should the command be restricted or disabled in server mode and only allowed in desktop mode?
I'm happy to write the patch and docs if this approach sounds right.
Thanks,
Simarjot Singh
