v0.2.2

Your servers don't all sit on the open internet, and they don't all log in the same way. v0.2.2 stops pretending they do.

New

• Jump hosts. If you reach the database through a bastion, say so in the ssh block:

  ssh {
    user       = "deploy"
    jump_hosts = ["deploy@bastion.example.com"]
  }

  Add more entries and Conn3x hops through each in turn. Every jump host's key is checked against known_hosts, the same as the target's.

• Your SSH config. Already have Host web1 in ~/.ssh/config? Point Conn3x at the file with ssh_config_file = "~/.ssh/config" and use the alias as the address. It picks up HostName, User, Port, IdentityFile, ProxyJump and UserKnownHostsFile. Anything you set in the ssh block still wins, and Conn3x reads nothing until you set the option.

• A login per host. A host in a circuit can now be an object instead of a bare address:

  hosts = {
    web = "10.0.0.4"
    db  = { address = "10.0.0.5", port = 2222, user = "admin" }
  }

  Its user, port, private_key_file, host_key and jump_hosts override the circuit's ssh block for that host alone. One circuit now covers a mixed fleet, and your inventory can be an ordinary variable or local.

• Homebrew. brew install conn3xorg/tap/conn3x works on macOS.

Changed

user is no longer required in the ssh block when your SSH config supplies it. If neither one sets it, the error says exactly that. Plain-address hosts and v0.1 configurations work unchanged.

Verify a download

cosign verify-blob \
  --certificate-identity 'https://github.com/conn3xorg/conn3x/.github/workflows/release.yml@refs/heads/main' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --bundle checksums.txt.sigstore.json checksums.txt
sha256sum --check --ignore-missing checksums.txt

Full changes: v0.1.1...v0.2.2

There are no v0.2.0 or v0.2.1 releases. Both builds failed at the Homebrew step, and their tags stay because tags here are never moved or deleted.