Nested Fabric Connections

The scenario is our production servers are sitting in a private subnet with a NAT instance in front of them to allow maintenance via SSH. Currently we connect to the NAT instance via SSH then via SSH from there to the respective server.

What I would like to do is run deployment tasks from my machine using the NAT as a proxy without uploading the codebase to the NAT instance. Is this possible with Fabric or am I just going to end up in a world of pain?

EDIT Just to follow up on this, as @Morgan suggested, the gateway option will indeed fix this issue.

For a bit of completeness, in my fabfile.py:

def setup_connections():
    """
    This should be called as the first task in all calls in order to setup the correct connections
    e.g. fab setup_connections task1 task2...
    """
    env.roledefs = {}

    env.gateway = '[email protected]' # where all the magic happens

    tag_mgr = EC2TagManager(...)

    for role in ['web', 'worker']:
        env.roledefs[role] = ['ubuntu@%s' % ins for ins in
                              tag_mgr.get_instances(instance_attr='private_ip_address', role=role)]


    env.key_filename = '/path/to/server.pem'

@roles('web')
def test_uname_web():
    run('uname -a')

I can now run fab setup_connections test_uname_web and I can get the uname of my web server

Solution

So if you have a newer version of Fabric (1.5+) you can try using the gateway options. I've never used it myself, but seems like what you'd want.

Documentation here:

Also if you run into any issues, all of us tend to idle in irc.