Infrastructure

All of it is registered by an admin under Infrastructure, and only by an admin. Registering means handing a credential to the platform, which should be a deliberate act by someone accountable for it.

The alias is what people type, so it is worth choosing well. prod-web-1 reads better than 10.0.0.5 and survives the machine being replaced.

Aliases are unique per project, which means production and staging can each have a db and nobody has to remember a prefix.

SSH targets carry free-form tags. They are what shortspan ssh exec @web "..." selects on, so tag by role and location: web, worker, db, eu-west.

Each SSH target has its own policy, at Infrastructure → SSH → Security. It constrains what the broker will do for that server regardless of who is asking.

Host key verification

Whether the server's host key must match a pinned fingerprint. Worth enabling for anything reachable over the public internet - without it, the connection is authenticated in one direction only.

Allow non-interactive exec

Whether shortspan ssh exec may run commands here at all. Some servers should only ever be entered by a person.

Allow port forwarding

Whether this server may be used as a bastion by shortspan db --via. Off means tunnelling through it is refused.

A database target can name an SSH target to reach it through. Register the SSH server first, then select it as the bastion when registering the database.

With a bastion configured, shortspan db <alias> tunnels automatically. Without one, --via names it per invocation. Either way, two credentials are brokered and audited separately.

If the bastion forbids port forwarding, --remote runs the database client on the server instead. See Database access.

A credential is encrypted on save and never displayed again - not to admins, not to owners, not in the platform control plane. The detail page shows the metadata: host, port, username, when it was registered, when it was last used, which encryption key version protects it, and who has been reaching it.

To change a credential, update the target with the new one. There is no "show me what is stored", because a store that will show you what it holds is a store one compromised admin session away from revealing everything.

The Free plan allows twenty-five infrastructure resources across the workspace; every paid tier is unlimited. The count includes SSH targets, database targets, AWS profiles, and Kubernetes contexts. Profiles are free - they reference resources rather than being one.