Deploying application with SSH tunnel

Question

I am developing spring-boot application where my backend-side is connecting to database using ssh tunneling (this part is required and cannot be changed). I have three ways to deploy application:

• creating jar (with embeded tomcat and ssh tunnel inside application)
• creating war and deploy on standalone tomcat (with ssh tunnel outside application as linux service)
• creating war and deploy on standalone tomcat (with ssh tunnel inside application), with this option is connected problem I cannot resolve https://stackoverflow.com/questions/49471387/spring-boot-tomcat-ssh-connection-link-failure

Which is best choice and why?

Answer 1

You should choose option 2:

creating war and deploy on standalone tomcat (with ssh tunnel outside application as linux service)

You want your SSH tunnel to be managed by the underlying OS, not by your app. This way it can be delegated by a SysAdmin (preferably using a configuration management tool).

An app you develop should not have to concern itself with managing system tasks like persisting a tunnel to the backend.

This aligns with the "12 Factor App" method of handling 'backing services':

The code for a twelve-factor app makes no distinction between local and third party services. To the app, both are attached resources, accessed via a URL or other locator/credentials stored in the config. A deploy of the twelve-factor app should be able to swap out a local MySQL database with one managed by a third party (such as Amazon RDS) without any changes to the app’s code.

So, if your codebase has anything related to creating an SSH tunnel or persisting the system connection, you're doing it wrong ;)