Deploy to private server behind public server using ssh

[L Rico]

Hi, i have application server which can only accessed via bastion server.

the topology is like 

The bastion server itself can be accessed from public, so have no issue to run pipeline.

I already add bitbucket generated "SSH Key" and "known hosts". It runs perfectly if i deploy to Bastion server.

What i've done :

1. Put bitbucket generated ssh Key to bastion & application server
2. add in the yaml file the result is run perfectly

image: atlassian/default-image:2
pipelines:
default:
- step:
name: 'Deployment to Staging'
deployment: staging
script:
- ssh -v -p 22 user@bastion_public_ip 'cd /var/www/html;git pull"'

3. Change in the yaml file the result is cannot connect. (Port 3000 is forwarding, I can access it from other server / my local)

script:
- ssh -v -p 3000 user@bastion_public_ip 'cd /var/www/html;git pull"'

4. Add the key directly in the yaml file, cannot connect

script:
- ........
- ssh -v -p 3000 -i bastion_key user@bastion_public_ip 'cd /var/www/html;git pull"'

Hope you guys can guide me the step and sample yaml file
Thank you

[Mark C]

Hi @L Rico

Welcome to the community.

Based on your updated command, you're now using port 3000.
For this, would it be possible for you to check if Pipelines can connect to your server via port 3000?
You can check it by using telnet and using the ssh -T command.

- apt-get update && apt-get install telnet
- telnet bastion_public_ip 3000
- ssh -Tv user@bastion_public_ip -p 3000

If Bitbucket Pipelines is not allowed to connect to your server, you might want to allowlist Bitbucket Pipelines IPs on your server/network.
You can find Pipelines IPs on this link. - What are the IP addresses to configure a corporate firewall? (Under "Valid IP addresses for Bitbucket Pipelines build environments")

Let me know how it goes.

Regards,
Mark C