# Yandex Cloud Managed PostgreSQL connection through a jump host

Minimal Infrastructure-as-Code project that provisions:

- ✅ Yandex Managed PostgreSQL (private)
- ✅ Ubuntu Jump Host (bastion)
- ✅ VPC network
- ✅ Secure SSH tunneling access
- ✅ Disposable test environment

This project demonstrates a **production-style secure database access pattern** using Terraform.

---

## ⚙️ Requirements

- Terraform ≥ 1.5
- Yandex Cloud account
- YC CLI installed and configured
- SSH client
- PostgreSQL client (`psql`)

---

## 🔑 SSH Key Setup

Create SSH key for jump host:

ssh-keygen -t ed25519 -f ~/.ssh/yc_jump

---

## 🚀 Deployment

terraform init
terraform plan
terraform apply -var-file terraform.tfvars

---

## 📤 Outputs

jump_host_ip = <PUBLIC_IP>
pg_host      = <PRIVATE_DB_HOST>
connection_string = psql ...

---

## 🔐 Connect to Database

### 1️⃣ Create SSH tunnel

ssh -i ~/.ssh/yc_jump -L 6432:<pg_host>:6432 ubuntu@<jump_host_ip>


Example:
ssh -i ~/.ssh/yc_jump -L 6432:rc1a-xxxx.mdb.yandexcloud.net:6432 ubuntu@93.xxx.xxx.xxx
---

### 2️⃣ Connect locally

psql "host=localhost port=6432 dbname=testdb user=testuser sslmode=require"

---

### ✅ Test

SELECT version();
SELECT inet_client_addr();

---

## 🔒 Security Model

| Component  | Exposure     |
| ---------- | ------------ |
| PostgreSQL | Private only |
| Jump Host  | Public SSH   |
| DB Access  | SSH tunnel   |
| Encryption | SSL + SSH    |


---

## 🧹 Destroy Infrastructure (optional)

terraform destroy

---