The ssh connector

The ssh connector is the default transport: a deploy runs over SSH on a real remote machine through asyncssh, mirroring the baseline's @ssh connector. It is selected per inventory entry with connection.connector — or simply by omitting the key, since "ssh" is the default:

inventory = [
    {
        "host": "web1",
        "connection": {
            "address": "192.168.0.240",
            "username": "kjarvis",
            "key_path": "~/.ssh/id_ed25519",
        },
    },
]

Connection options

Unlike the docker connector's closed key set, the ssh connection mapping keeps asyncssh's own key names and forwards a curated set of asyncssh.connect options verbatim. Forwarding is presence-based, so an explicit None is meaningful (e.g. known_hosts=None skips host key checking, client_keys=None loads no default identities). Path-valued options (key_path, client_keys, agent_path, config, identities, known_hosts) have ~ expanded before they reach asyncssh.

Option	Purpose
connector	"ssh" (the default) selects this connector; may be omitted
address / host / hostname	The SSH target address — required to connect
username / user	Login name
port	TCP port to connect to
password	Password authentication
key_path	Single client private key (shorthand for client_keys)
client_keys	Client private keys (list); None loads no default identities
passphrase	Passphrase for encrypted keys
identities	Certificates/identities to present
agent_path	SSH agent socket (None uses the default)
agent_forwarding	Forward the agent to the remote host
config	OpenSSH config file path(s), or True for the default
known_hosts	Known-hosts file path(s); None skips host key checking
proxy_command	Jump-host ProxyCommand string, run on the controller
tunnel	Bastion tunnel, as "[user@]host[:port]" or a connection
kex_algs	Key-exchange algorithm pinning for compliance or legacy servers
encryption_algs	Cipher algorithm pinning
mac_algs	MAC algorithm pinning
server_host_key_algs	Host-key algorithm pinning
preferred_auth	Auth method order, e.g. ["publickey", "password"]
login_timeout	Auth window in seconds
keepalive_interval	Seconds between SSH-level keepalive probes
keepalive_count_max	Unanswered keepalives before the connection is dropped
tcp_keepalive	Enable TCP-level keepalives
asyncssh_connect_kwargs	Passthrough mapping for any other asyncssh.connect option, merged last