An ssh config that made a runbook one word long

A runbook step that read “ssh to the app server, jumping through the bastion, as the deploy user, with the right key” is a config entry, not an instruction.

# ~/.ssh/config
Host bastion
  HostName bastion.example
  User jump
  IdentityFile ~/.ssh/id_bastion

Host app-*
  User deploy
  IdentityFile ~/.ssh/id_deploy
  ProxyJump bastion
  ServerAliveInterval 30

# the runbook step becomes: ssh app-1

Every parameter in a runbook that a human has to type is a parameter they can type wrong at three in the morning. ProxyJump replaced a ProxyCommand with a nested ssh invocation that had been copied between machines for years and worked slightly differently on each. Committing this to a shared repository as a template, with the hostnames filled in by a script, is what made it survive onboarding.