mantis-cli 22.1.0__tar.gz → 22.2.0__tar.gz

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: mantis_cli
-Version: 22.1.0
+Version: 22.2.0
 Summary: Management command to build and deploy webapps, especially based on Django
 Home-page: https://github.com/PragmaticMates/mantis-cli
 Author: Erik Telepovský
@@ -69,6 +69,10 @@ You can use ``<MANTIS>`` variable in your paths if needed as a relative referenc
 | project_path             | string | path to folder with project files on remote server           |
 | connection               | string | single connection string (use instead of connections)        |
 | connections              | dict   | definition of your connections for each environment          |
+| tunnel                   | dict   | SSH tunnel settings                                          |
+| tunnel.enabled           | bool   | share a single SSH connection for the whole run (null = auto)|
+| tunnel.remote_socket     | string | path to the docker socket on the server                      |
+| tunnel.ssh_options       | array  | extra options passed to the ssh command                      |
 
 TODO:
 - default values
@@ -144,6 +148,70 @@ Environment files are looked up directly in the `environment.folder` instead of
 
 **Note:** You cannot define both `connection` and `connections` in the same config file.
 
+#### SSH tunnel
+
+With a plain `ssh://` connection, Docker opens a **separate SSH connection for every
+command** mantis runs. A single deployment issues dozens of them, and `compose pull` fans
+out over all services at once. That burst runs into sshd's `MaxStartups`, which drops
+connections beyond its threshold:
+
+```
+kex_exchange_identification: read: Connection reset by peer
+```
+
+It is also slow when the connection goes through a `ProxyCommand` (Cloudflare Access,
+bastion hosts, ...), because each connection spawns its own proxy process.
+
+The tunnel makes mantis open **one** SSH connection per run, forwarding the remote docker
+socket to a local one and pointing every docker command at it.
+
+Docker itself offers no way to pass `ssh` options (`ControlMaster` and friends), so this
+is handled entirely by mantis — no `~/.ssh/config` changes are needed, and connection
+details keep coming from your `ssh://` connection string. Unlike `ControlMaster`
+multiplexing, forwarded channels are not counted against sshd's `MaxSessions`, so no
+server-side configuration is required either.
+
+`tunnel.enabled` decides how much mantis verifies before trusting it:
+
+| value | behaviour |
+|-------|-----------|
+| unset (default) | detect per run: tunnel, and keep it only if the docker daemon answers through it |
+| `true` | tunnel without detecting, for a server already known to support it |
+| `false` | never tunnel |
+
+```json
+"tunnel": {
+    "enabled": true
+}
+```
+
+Detection costs one extra round-trip per run and cannot be skipped by opening the forward
+alone: `ssh -L` to a unix socket succeeds even when nothing listens on the far end, so a
+tunnel only proves itself once the daemon has replied. Set `enabled` explicitly once
+`check-tunnel` (below) confirms a server, and that round-trip goes away.
+
+Requirements on the server: the connecting user must be able to read the docker socket
+(typically membership in the `docker` group), and `AllowStreamLocalForwarding` must not
+be disabled — it defaults to `yes`. Whenever the tunnel cannot be used, mantis warns and
+falls back to a connection per docker command, so deployments keep working either way.
+
+The check ignores `tunnel.enabled`, so it answers "would this work" rather than "is this
+on" — use it before setting `enabled` to `true`:
+
+```bash
+mantis -e production check-tunnel
+```
+
+It opens the tunnel, asks the remote docker daemon for its version and closes it again,
+exiting non-zero on failure. A refused forward and an unreachable socket are reported
+separately, since they need different fixes (`sshd_config` versus group membership).
+
+Pass `--no-tunnel` to disable it for a single run:
+
+```bash
+mantis -e production --no-tunnel deploy
+```
+
 ### Encryption
 
 If you plan to use encryption and decryption of your environment files, you need to create encryption key.
@@ -323,6 +391,7 @@ Run `mantis --help` to see all available commands with their descriptions.
 | contexts                              | Prints all docker contexts                                |
 | create-context                        | Creates docker context                                    |
 | ssh                                   | Connects to remote host via SSH                           |
+| check-tunnel                          | Checks if the docker socket can be tunnelled over SSH     |
 
 **Django extension:**
 

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/README.md

@@ -47,6 +47,10 @@ You can use ``<MANTIS>`` variable in your paths if needed as a relative referenc
 | project_path             | string | path to folder with project files on remote server           |
 | connection               | string | single connection string (use instead of connections)        |
 | connections              | dict   | definition of your connections for each environment          |
+| tunnel                   | dict   | SSH tunnel settings                                          |
+| tunnel.enabled           | bool   | share a single SSH connection for the whole run (null = auto)|
+| tunnel.remote_socket     | string | path to the docker socket on the server                      |
+| tunnel.ssh_options       | array  | extra options passed to the ssh command                      |
 
 TODO:
 - default values
@@ -122,6 +126,70 @@ Environment files are looked up directly in the `environment.folder` instead of
 
 **Note:** You cannot define both `connection` and `connections` in the same config file.
 
+#### SSH tunnel
+
+With a plain `ssh://` connection, Docker opens a **separate SSH connection for every
+command** mantis runs. A single deployment issues dozens of them, and `compose pull` fans
+out over all services at once. That burst runs into sshd's `MaxStartups`, which drops
+connections beyond its threshold:
+
+```
+kex_exchange_identification: read: Connection reset by peer
+```
+
+It is also slow when the connection goes through a `ProxyCommand` (Cloudflare Access,
+bastion hosts, ...), because each connection spawns its own proxy process.
+
+The tunnel makes mantis open **one** SSH connection per run, forwarding the remote docker
+socket to a local one and pointing every docker command at it.
+
+Docker itself offers no way to pass `ssh` options (`ControlMaster` and friends), so this
+is handled entirely by mantis — no `~/.ssh/config` changes are needed, and connection
+details keep coming from your `ssh://` connection string. Unlike `ControlMaster`
+multiplexing, forwarded channels are not counted against sshd's `MaxSessions`, so no
+server-side configuration is required either.
+
+`tunnel.enabled` decides how much mantis verifies before trusting it:
+
+| value | behaviour |
+|-------|-----------|
+| unset (default) | detect per run: tunnel, and keep it only if the docker daemon answers through it |
+| `true` | tunnel without detecting, for a server already known to support it |
+| `false` | never tunnel |
+
+```json
+"tunnel": {
+    "enabled": true
+}
+```
+
+Detection costs one extra round-trip per run and cannot be skipped by opening the forward
+alone: `ssh -L` to a unix socket succeeds even when nothing listens on the far end, so a
+tunnel only proves itself once the daemon has replied. Set `enabled` explicitly once
+`check-tunnel` (below) confirms a server, and that round-trip goes away.
+
+Requirements on the server: the connecting user must be able to read the docker socket
+(typically membership in the `docker` group), and `AllowStreamLocalForwarding` must not
+be disabled — it defaults to `yes`. Whenever the tunnel cannot be used, mantis warns and
+falls back to a connection per docker command, so deployments keep working either way.
+
+The check ignores `tunnel.enabled`, so it answers "would this work" rather than "is this
+on" — use it before setting `enabled` to `true`:
+
+```bash
+mantis -e production check-tunnel
+```
+
+It opens the tunnel, asks the remote docker daemon for its version and closes it again,
+exiting non-zero on failure. A refused forward and an unreachable socket are reported
+separately, since they need different fixes (`sshd_config` versus group membership).
+
+Pass `--no-tunnel` to disable it for a single run:
+
+```bash
+mantis -e production --no-tunnel deploy
+```
+
 ### Encryption
 
 If you plan to use encryption and decryption of your environment files, you need to create encryption key.
@@ -301,6 +369,7 @@ Run `mantis --help` to see all available commands with their descriptions.
 | contexts                              | Prints all docker contexts                                |
 | create-context                        | Creates docker context                                    |
 | ssh                                   | Connects to remote host via SSH                           |
+| check-tunnel                          | Checks if the docker socket can be tunnelled over SSH     |
 
 **Django extension:**
 

mantis_cli-22.2.0/mantis/__init__.py

@@ -0,0 +1 @@
+VERSION = '22.2.0'

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/app.py

@@ -191,6 +191,7 @@ def main(
     environment: Optional[str] = typer.Option(None, "--env", "-e", help="Environment ID"),
     mode: str = typer.Option("remote", "--mode", "-m", help="Execution mode: remote, ssh, host"),
     dry_run: bool = typer.Option(False, "--dry-run", "-n", help="Show commands without executing"),
+    no_tunnel: bool = typer.Option(False, "--no-tunnel", help="Do not tunnel the remote docker socket over a single SSH connection"),
     version: bool = typer.Option(False, "--version", "-v", callback=version_callback, is_eager=True, help="Show version and exit"),
 ):
     """Mantis CLI - Docker deployment tool."""
@@ -216,4 +217,4 @@ def main(
 
     state._mode = mode
     state._dry_run = dry_run
-    state._manager = get_manager(environment, mode, dry_run=dry_run, commands=commands)
+    state._manager = get_manager(environment, mode, dry_run=dry_run, commands=commands, use_tunnel=not no_tunnel)

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/command_line.py

@@ -99,6 +99,7 @@ def parse_global_options(global_opts: List[str]) -> dict:
         'env': None,
         'mode': 'remote',
         'dry_run': False,
+        'use_tunnel': True,
     }
 
     i = 0
@@ -113,6 +114,9 @@ def parse_global_options(global_opts: List[str]) -> dict:
         elif opt in ('-n', '--dry-run'):
             result['dry_run'] = True
             i += 1
+        elif opt == '--no-tunnel':
+            result['use_tunnel'] = False
+            i += 1
         else:
             i += 1
 
@@ -185,7 +189,7 @@ def run():
     all_commands = [group[0] for group in cmd_groups if group]
     state._mode = opts['mode']
     state._dry_run = opts['dry_run']
-    state._manager = get_manager(opts['env'], opts['mode'], dry_run=opts['dry_run'], commands=all_commands)
+    state._manager = get_manager(opts['env'], opts['mode'], dry_run=opts['dry_run'], commands=all_commands, use_tunnel=opts['use_tunnel'])
 
     # Get Click app from Typer
     click_app = typer.main.get_command(app)

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/commands/connection.py

@@ -1,4 +1,6 @@
-"""Connection commands: contexts, create-context, ssh."""
+"""Connection commands: contexts, create-context, ssh, check-tunnel."""
+import typer
+
 from mantis.app import command, state
 
 
@@ -18,3 +20,10 @@ def create_context():
 def ssh_cmd():
     """Connects to remote host via SSH"""
     state.ssh()
+
+
+@command(name="check-tunnel", panel="Connections")
+def check_tunnel():
+    """Checks if the docker socket can be tunnelled over SSH"""
+    if not state.check_tunnel():
+        raise typer.Exit(code=1)

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/managers.py

@@ -1,8 +1,12 @@
 import asyncio
+import atexit
 import json
 import os
+import shutil
 import subprocess
 import sys
+import tempfile
+import threading
 import time
 import yaml
 from collections import defaultdict
@@ -27,11 +31,19 @@ class AbstractManager(object):
     """
     environment_id = None
 
-    def __init__(self, config_file: str = None, environment_id: str = None, mode: str = 'remote', dry_run: bool = False):
+    def __init__(self, config_file: str = None, environment_id: str = None, mode: str = 'remote', dry_run: bool = False, use_tunnel: bool = True):
         self.environment_id = environment_id
         self.mode = mode
         self.dry_run = dry_run
 
+        # SSH tunnel state (see ensure_tunnel)
+        self.use_tunnel = use_tunnel
+        self._tunnel_lock = threading.Lock()
+        self._tunnel_socket = None
+        self._tunnel_control_socket = None
+        self._tunnel_dir = None
+        self._tunnel_failed = False
+
         # config file
         self.config_file = config_file
 
@@ -118,6 +130,202 @@ class AbstractManager(object):
 
         return details
 
+    @property
+    def tunnel_config(self) -> Dict[str, Any]:
+        return self.config.get('tunnel', {})
+
+    def ensure_tunnel(self) -> Optional[str]:
+        """
+        Returns path of a local unix socket forwarded to the remote docker socket,
+        opening the SSH master connection on first use.
+
+        Returns None when tunnelling does not apply (disabled, non-ssh connection, ...) or
+        when it turns out to be unavailable. In both cases the caller falls back to a
+        plain ssh:// docker host.
+
+        An explicitly enabled tunnel is used straight away. An unset one is detected: the
+        forward succeeds even when nothing listens on the remote socket, so availability
+        is only known once the docker daemon has answered through it.
+        """
+        if self._tunnel_socket:
+            return self._tunnel_socket
+
+        with self._tunnel_lock:
+            # another thread may have opened it meanwhile
+            if self._tunnel_socket or self._tunnel_failed:
+                return self._tunnel_socket
+
+            enabled = self.tunnel_config.get('enabled')
+
+            if not self.use_tunnel or enabled is False:
+                return None
+
+            if self.mode != 'remote':
+                return None
+
+            if not self.connection or not self.connection.startswith('ssh://'):
+                return None
+
+            if not self.host or not self.user:
+                return None
+
+            # an explicitly enabled tunnel is trusted, an unset one is verified
+            detect = enabled is None and not self.dry_run
+
+            if detect:
+                CLI.info('Tunnel not configured, checking if it is available...')
+
+            # assigned before probing, so the docker call below does not re-enter here
+            self._tunnel_socket = self.start_tunnel()
+
+            if self._tunnel_socket and detect:
+                version = self.probe_tunnel()
+
+                if version:
+                    CLI.success(f'Tunnel is available (docker {version}). '
+                                f'Enable it in config to skip this check.')
+                else:
+                    CLI.warning(
+                        'Docker daemon did not answer through the SSH tunnel.\n'
+                        'Falling back to a separate SSH connection per docker command.'
+                    )
+                    self.stop_tunnel()
+
+            self._tunnel_failed = self._tunnel_socket is None
+
+            return self._tunnel_socket
+
+    def probe_tunnel(self) -> Optional[str]:
+        """
+        Returns the version of the docker daemon answering through the tunnel,
+        or None when nothing answers on the remote socket.
+        """
+        version = self.docker('version --format "{{.Server.Version}}"', return_output=True)
+        version = version.strip() if version else ''
+
+        return version or None
+
+    def start_tunnel(self) -> Optional[str]:
+        """
+        Opens a single backgrounded SSH master forwarding the remote docker socket.
+        Every docker command then reuses it instead of opening its own connection.
+        """
+        remote_socket = self.tunnel_config.get('remote_socket', '/var/run/docker.sock')
+        ssh_options = self.tunnel_config.get('ssh_options', [])
+
+        # unix socket paths are limited to ~104 characters, so prefer a shallow base
+        # directory over the default temp folder (macOS uses a deep /var/folders/... one)
+        base_dir = '/tmp' if Path('/tmp').is_dir() else None
+
+        self._tunnel_dir = tempfile.mkdtemp(prefix='mantis-', dir=base_dir)
+        local_socket = str(Path(self._tunnel_dir) / 'docker.sock')
+        control_socket = str(Path(self._tunnel_dir) / 'ssh.ctl')
+
+        command = [
+            'ssh', '-f', '-N', '-M',
+            '-S', control_socket,
+            '-o', 'ExitOnForwardFailure=yes',
+            '-o', 'ServerAliveInterval=30',
+            '-o', 'ServerAliveCountMax=3',
+            '-L', f'{local_socket}:{remote_socket}',
+            '-p', str(self.port or 22),
+            *ssh_options,
+            f'{self.user}@{self.host}',
+        ]
+
+        if self.dry_run:
+            CLI.warning(f'[DRY-RUN] {" ".join(command)}')
+            self.remove_tunnel_dir()
+            return local_socket
+
+        CLI.info(f'Opening SSH tunnel to {self.user}@{self.host}...')
+
+        # ssh -f keeps its inherited output open in the backgrounded process, so a pipe
+        # would never reach EOF and subprocess.run would block forever. Use a file.
+        output_file = Path(self._tunnel_dir) / 'ssh.log'
+
+        with open(output_file, 'w') as output:
+            result = subprocess.run(command, stdin=subprocess.DEVNULL, stdout=output, stderr=output)
+
+        if result.returncode != 0:
+            CLI.warning(
+                f'Failed to open SSH tunnel: {output_file.read_text().strip()}\n'
+                f'Falling back to a separate SSH connection per docker command.'
+            )
+            self.remove_tunnel_dir()
+            return None
+
+        self._tunnel_control_socket = control_socket
+        atexit.register(self.stop_tunnel)
+
+        return local_socket
+
+    def stop_tunnel(self) -> None:
+        """
+        Closes the SSH master connection and removes its temporary files. Idempotent.
+        """
+        if self._tunnel_control_socket:
+            subprocess.run(
+                ['ssh', '-S', self._tunnel_control_socket, '-O', 'exit', f'{self.user}@{self.host}'],
+                capture_output=True, text=True
+            )
+            self._tunnel_control_socket = None
+
+        self._tunnel_socket = None
+        self.remove_tunnel_dir()
+
+    def remove_tunnel_dir(self) -> None:
+        if self._tunnel_dir:
+            shutil.rmtree(self._tunnel_dir, ignore_errors=True)
+            self._tunnel_dir = None
+
+    def check_tunnel(self) -> bool:
+        """
+        Verifies the SSH tunnel can be used for this connection, regardless of whether it
+        is enabled in the config. Opens it, queries the remote docker daemon and closes it
+        again, telling apart a refused forward from a missing access to the docker socket.
+        """
+        if self.mode != 'remote':
+            CLI.error(f'Tunnel is only used in remote mode, not in "{self.mode}" mode.')
+
+        if not self.connection:
+            env_info = f' for environment {self.environment.id}' if self.environment.id else ''
+            CLI.error(f'Connection{env_info} not defined!')
+
+        if not self.connection.startswith('ssh://'):
+            CLI.error(f'Tunnel requires an ssh:// connection, but this one is "{self.connection}".')
+
+        remote_socket = self.tunnel_config.get('remote_socket', '/var/run/docker.sock')
+
+        if self.tunnel_config.get('enabled') is False:
+            CLI.warning('Tunnel is disabled in config, checking anyway...')
+
+        CLI.step(1, 2, f'Forwarding {self.user}@{self.host}:{remote_socket}')
+
+        # bypass ensure_tunnel, the point of the check is to ignore the config
+        self._tunnel_socket = self.start_tunnel()
+
+        if not self._tunnel_socket:
+            CLI.danger('Tunnel is NOT available.')
+            CLI.info(f'The server may not allow forwarding of unix sockets. '
+                     f'Check "AllowStreamLocalForwarding" in its sshd_config.')
+            return False
+
+        CLI.step(2, 2, 'Querying docker daemon through the tunnel')
+
+        version = self.probe_tunnel()
+
+        self.stop_tunnel()
+
+        if not version:
+            CLI.danger('Tunnel is NOT available.')
+            CLI.info(f'The forward works, but the docker daemon did not answer on {remote_socket}. '
+                     f'Make sure user "{self.user}" can access it (usually by being in the "docker" group).')
+            return False
+
+        CLI.success(f'Tunnel is available (docker {version}).')
+        return True
+
     @property
     def docker_connection(self) -> str:
         # In single connection mode or when env.id contains 'local', no extra connection needed
@@ -129,6 +337,11 @@ class AbstractManager(object):
                 env_info = f' for environment {self.environment.id}' if self.environment.id else ''
                 CLI.error(f'Connection{env_info} not defined!')
             if self.connection.startswith('ssh://'):
+                tunnel_socket = self.ensure_tunnel()
+
+                if tunnel_socket:
+                    return f'DOCKER_HOST="unix://{tunnel_socket}"'
+
                 return f'DOCKER_HOST="{self.connection}"'
             elif self.connection.startswith('context://'):
                 context_name = self.connection.replace('context://', '')
@@ -1668,6 +1881,11 @@ def get_extension_classes(extensions: List[str]) -> List[type]:
 
 SECRETS_COMMANDS = {'show-env', 'encrypt-env', 'decrypt-env', 'check-env'}
 
+# Commands running against the local docker daemon, so they need no connection
+# (see use_connection=False in build and push). They accept any environment which is
+# either defined as a connection or has an environment folder.
+LOCAL_COMMANDS = {'build', 'b', 'push', 'p'}
+
 
 def validate_environment_for_commands(environment_id: str, config: Dict[str, Any], config_file: str, commands: list) -> None:
     """
@@ -1697,6 +1915,12 @@ def validate_environment_for_commands(environment_id: str, config: Dict[str, Any
             if environment_id not in folder_envs:
                 CLI.error(f'Environment "{environment_id}" not available for command "{cmd}". '
                          f'Available environments (folders): {", ".join(sorted(folder_envs)) if folder_envs else "none"}')
+        elif cmd in LOCAL_COMMANDS:
+            # Local command needs no connection, a folder-based environment is enough
+            if 'local' not in environment_id and environment_id not in connection_envs and environment_id not in folder_envs:
+                available = ['local'] + connection_envs + folder_envs
+                CLI.error(f'Environment "{environment_id}" not available for command "{cmd}". '
+                         f'Available environments: {", ".join(sorted(set(available)))}')
         else:
             # Other commands need connection or 'local'
             if 'local' not in environment_id and environment_id not in connection_envs:
@@ -1729,6 +1953,7 @@ def resolve_environment(environment_id: Optional[str], config: Dict[str, Any], c
         folder_envs = [d.name for d in env_path.iterdir() if d.is_dir()]
 
     # For secrets commands: use folder-based environments only
+    # For local commands: use connections + folders + local
     # For other commands: use connections + local
     if command in SECRETS_COMMANDS:
         available_envs = folder_envs
@@ -1737,8 +1962,13 @@ def resolve_environment(environment_id: Optional[str], config: Dict[str, Any], c
         if 'local' in environment_id:
             return environment_id
 
-        connections = config.get('connections', {})
-        available_envs = ['local'] + list(connections.keys())
+        connection_envs = list(config.get('connections', {}).keys())
+
+        if command in LOCAL_COMMANDS:
+            # no connection needed, a folder-based environment is enough
+            available_envs = list(dict.fromkeys(['local'] + connection_envs + folder_envs))
+        else:
+            available_envs = ['local'] + connection_envs
 
     # Check for exact match first
     if environment_id in available_envs:
@@ -1756,7 +1986,7 @@ def resolve_environment(environment_id: Optional[str], config: Dict[str, Any], c
         CLI.error(f'Environment "{environment_id}" not found. Available: {", ".join(sorted(available_envs))}')
 
 
-def get_manager(environment_id: Optional[str], mode: str, dry_run: bool = False, commands: list = None) -> BaseManager:
+def get_manager(environment_id: Optional[str], mode: str, dry_run: bool = False, commands: list = None, use_tunnel: bool = True) -> BaseManager:
     # config file
     config_file = find_config(environment_id, commands=commands)
     config = load_config(config_file)
@@ -1785,7 +2015,7 @@ def get_manager(environment_id: Optional[str], mode: str, dry_run: bool = False,
     class MantisManager(*[manager_class] + extension_classes):
         pass
 
-    manager = MantisManager(config_file=config_file, environment_id=environment_id, mode=mode, dry_run=dry_run)
+    manager = MantisManager(config_file=config_file, environment_id=environment_id, mode=mode, dry_run=dry_run, use_tunnel=use_tunnel)
 
     # set extensions data
     for extension, extension_params in extensions.items():

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/mantis.tpl

@@ -33,5 +33,10 @@
   "project_path": "~",
   "connection": null,
   "connections": {
+  },
+  "tunnel": {
+    "enabled": null,
+    "remote_socket": "/var/run/docker.sock",
+    "ssh_options": []
   }
 }

{mantis_cli-22.1.0 → mantis_cli-22.2.0}/mantis/schema.py

@@ -38,6 +38,22 @@ class EnvironmentConfig(BaseModel):
     file_prefix: str = ""
 
 
+class TunnelConfig(BaseModel):
+    """
+    SSH tunnel forwarding the remote docker socket to a local one.
+
+    Without it, every docker/compose call opens its own SSH connection, which bursts
+    past sshd's MaxStartups (and multiplies ProxyCommand processes). With it, the whole
+    mantis run shares a single SSH connection.
+
+    Leave "enabled" unset to detect availability per run, set it to true to skip that
+    detection on a server known to support it, or to false to never tunnel at all.
+    """
+    enabled: Optional[bool] = None
+    remote_socket: str = "/var/run/docker.sock"
+    ssh_options: List[str] = Field(default_factory=list)
+
+
 class MantisConfig(BaseModel):
     """Main mantis configuration schema."""
     # Extensions
@@ -57,6 +73,7 @@ class MantisConfig(BaseModel):
     # Connections (mutually exclusive)
     connection: Optional[str] = None
     connections: Dict[str, str] = Field(default_factory=dict)
+    tunnel: TunnelConfig = Field(default_factory=TunnelConfig)
 
     # Custom manager class
     manager_class: str = "mantis.managers.BaseManager"