SSH and TLS
SSH tunnels
Turn on Connect over SSH in the Take the secret tunnel panel. It is available for PostgreSQL, MySQL, SQL Server, Redis, MongoDB, Trino and ClickHouse.
| Field | Notes |
|---|---|
| SSH Host | The bastion, e.g. bastion.example.com |
| SSH Port | 22 by default |
| SSH User | |
| Auth | Agent / default keys, Key file or Password |
- Agent / default keys uses your
ssh-agentand the default keys in~/.ssh. Nothing secret is stored. - Key file takes the path of a private key, plus the passphrase if the key has one.
- Password takes the SSH password.
The database Host and Port in the form are resolved from the SSH server, so use the address the bastion sees (often localhost or a private name).
How the tunnel runs:
- Lily starts the system
sshwith local port forwarding, so your~/.ssh/configand agent apply as they do in Terminal. - A host it has never seen is accepted and remembered. A host whose key changed is refused.
- Passwords and passphrases are handed to
sshthrough an askpass helper, never on the command line, and are kept in the Keychain. - The tunnel gives up after 10 seconds if the bastion does not answer.
TLS
| Engine | Option | Certificate check |
|---|---|---|
| PostgreSQL | Use TLS / SSL | Verify server certificate rejects untrusted and self-signed certificates, like sslmode=verify-full |
| MySQL | Use TLS / SSL | Verify server certificate, same as PostgreSQL |
| SQL Server | Use TLS / SSL | Encrypts without verifying the certificate. Without TLS, only the login is encrypted |
| MongoDB | Use TLS / SSL | System trust |
| Trino | Use HTTPS | System trust |
| ClickHouse | Use HTTPS | System trust. Change the port yourself (HTTPS is usually 8443) |
| DynamoDB | Always HTTPS to AWS | System trust |
| Redis | Not supported | Use an SSH tunnel |
"System trust" means the certificate must be valid for macOS; a self-signed certificate fails.
Passwords over plain HTTP
Trino refuses to send a password over plain HTTP: turn on Use HTTPS. ClickHouse does send it over plain HTTP, so prefer HTTPS or an SSH tunnel for anything that is not on your own machine.
Redis TLS is not supported yet. A rediss:// URL is refused instead of silently connecting in plain text; connect through an SSH tunnel instead.