Graft 2.7.0

What's new in 2.7.0

• Service Scaling: Scale any service to N replicas with [graft scale <service> <n>] — Traefik load balances automatically. Scale persists through deploys.
• PSQL Passthrough: Full psql passthrough with env-aware auto-connect. Supports all native psql flags (-c, -f, -t, etc.).
• Isolated DB Credentials (Security): Each database gets a dedicated Postgres user and password. Admin credentials never leak to project secrets.
• Per-Environment Database Linking: Database auto-linked per environment. [graft psql] connects to the right db for the current env.
• Unified DB Init: Initialize databases from project scope, host scope [graft host db], or registry scope [graft -r <name> db]. All paths prompt to link with overwrite protection.
• SSH Database Tunnel: [graft db <name> serve :port] tunnels remote Postgres to localhost via SSH for local dev tools. No public port exposure.
• Generic Service Tunnel: [graft host tunnel <container> -port remote:local] tunnels any Docker container to localhost. Auto-detects exposed ports when -port is omitted.
• Tunnel Port Flag Renamed (Breaking): The tunnel port mapping is now -port (or --port) instead of -p, since -p is the global project flag. Update any scripts that passed -p for a tunnel port.
• Default Registry: [graft -default <name>] marks a registry as the fallback for work outside a project. With no -r, no -p and no project in the current directory, Graft runs what [graft -r <default> <command>] would have run.
• SSH Connection Reliability: Multiple concurrent sessions and tunnels no longer hang. The liveness probe, SSH handshake and authentication, channel opens, and SFTP startup are all bounded by timeouts, so a half-dead connection fails fast and self-heals instead of blocking forever.
• Faster Connections: SFTP starts only when a command actually transfers files, and tunnels no longer spend a network round trip probing liveness before each forwarded connection.
• known_hosts Correctness (Security): Non-default ports are recorded in the format the lookup uses, so repeat connections stop appending duplicates. An unreadable known_hosts is reported instead of silently skipping host key verification.
• Environment Listing: [graft env ls] shows all environments with registry, domain, and mode.
• Graft SSH Key: Manage SSH keys with [graft pub] and rotate with [graft pub rollout].
• Cloudflare API Integration: Automated DNS zone mapping based on Traefik host labels. …

Full release notes »