The Database tab now speaks Oracle and Microsoft SQL Server (MSSQL), both with pure-Go drivers: nothing to install next to the app. A GitLab runner can send its jobs through your VPNs and bastions, several customers at once, set up from Settings.
CI runner
- GitLab jobs through the VPNs. Settings -> Network profiles -> CI runner runs a GitLab runner in Docker whose jobs reach every VPN marked Reachable through the app proxy, each address through the VPN that carries it, without touching
.gitlab-ci.yml. Set it up with the GitLab URL and a runner token, or import your existingconfig.toml(cache, image, volumes and extra_hosts are kept; only the docker executor is supported), several[[runners]]included. Tokens and cache keys go to the vault and show as(saved in the vault), and the config is copied into the runner container, never written to disk. - The jobs get their own docker network whose router is the gateway: the VPNs' networks go into the app proxy, everything else (clone, cache, registry, internet) goes out as usual. The GitLab host and an S3 cache stay off the VPNs even when a customer's networks contain them; anything else in a customer's range (a registry, say) can be added under Never through a VPN, and Extra hosts adds names only a customer's DNS knows.
- The gateway follows the app proxy while the runner runs: VPNs, networks and jump-host connections added later reach its routes within 20 seconds, without a restart or cutting running jobs.
- The runner is per machine: its settings and secrets do not travel with the synced profile, so two machines never run the same runner token. Whether the app proxy listens, and where, is per machine too.
- Start and Stop on its page, Stop when the vault locks (on by default, the runner holds its tokens), Start with the app once the vault is open, Logs for the runner's log, and a status bar segment while it runs. Quitting ssh-tool stops it.
- The earlier recipe,
network_mode = "container:sshtool-gw"in the runner's own config, never worked for real jobs: the runner gives every job a hostname, which Docker refuses in that mode. Use the CI runner page instead; Copy gateway command stays for other containers.
App proxy
- Overlapping networks, decided by you. When several VPNs carry the same range (two customers with
10.0.0.0/8), tick the ones that should win under When networks overlap and order them; a ticked VPN takes every address its networks contain. An address added by hand on a profile's Proxy tab, or a connection's address, always goes through that profile. This replaces the single "When networks overlap, use" choice, which carries over as the first in the order. - Which VPN for... tells which VPN an address or name would go through, and why.
- Jump hosts too. A connection in the tree with a jump host (set on it or its folder, a tree connection or a typed host) is reached through the app proxy the way its terminal connects: its VPN comes up as its mode says, then the jump chain, and the address is opened from the last hop, once you tick Connections with a jump host. A CI job or
curlnever sees a key or a password; the bastion must allow TCP forwarding. Open shared bastions (terminals, the app proxy and CI alike) show in the status bar.
Databases
- Oracle (12c and newer): log in to a service name (or
sid:NAME), browse its schemas, tables, views and materialized views with structure and DDL, and query. PL/SQL blocks keep their semicolons and end at a/line as in SQL*Plus;DBMS_OUTPUTshows under the block's result. Read-only tabs sendSELECT/WITHonly, inside aSET TRANSACTION READ ONLYthat is rolled back. - SQL Server (and Azure SQL): databases, schemas, tables and views with row counts, structure and a rebuilt DDL;
GOends a batch,PRINToutput and extra result sets are shown,BEGIN TRANholds a transaction across runs with the usual "in transaction" badge. Read-only tabs send a plainSELECT/WITHonly, since SQL Server has no read-only transaction and T-SQL needs no semicolon between statements. - Both run through the connection's SSH session like the other engines, Stop cancels a running statement and keeps the session, and the LLM bridge (MCP) reaches them the same way.
- What a statement prints (
DBMS_OUTPUT,PRINT) now shows under a result without rows too.
Network profiles
- The "plugin is not installed" note on a new NetBird, Tailscale, OpenConnect, OpenVPN or Check Point profile now has an Install it link that opens the plugin list and flashes that plugin. The list's first row, which held the plugins and the app proxy as General, is now Plugins & proxy.
- The OpenConnect plugin card showed its engine as
(devel); it now reads0.1.0 (patched), the upstream version our patched copy is based on.
Windows
- Detached windows come back. Quitting with tabs in separate windows used to reopen only the main window's tabs; each detached window now reopens as its own window with all its tabs. A window closed by hand or redocked before the quit stays closed.
- Several tabs to a new window. With tabs selected (Ctrl / Shift click), Detach N tabs to a new window in the tab menu, or dragging them out, takes them all into one window, splits included.
- Workspaces in their own window. A workspace's label can be dragged out of the window, and the Workspaces menu has Open in a new window for each one; the workspace keeps its frame there and can be saved from it.
- Detached windows have a status bar like the main window. Its links to Settings, and a pane's Edit this connection, bring the main window forward and open what was asked for there.
Fixes
- Edit this connection (the settings button in a pane's header) did nothing in a detached window, which has no connection tree. It now brings the main window forward with that connection selected and its settings open.
- A detached window's taskbar entry read "ssh-tool"; it now names the window's active tab.