DigitalOcean

The Sync tab (4) imports Linux Droplets into Bast. Synced hosts remain ordinary OpenSSH entries, while their connection details, label, and group stay owned by DigitalOcean sync.

Bast uses the native doctl CLI on your machine. It does not store DigitalOcean tokens or use a separate cloud agent. Discovery, create, power, snapshot, and SSH key matching run through the doctl auth contexts you already use.

Bast supports GCP, AWS, Azure, Boat, Fly.io, and DigitalOcean through each provider's native CLI, and Upstash Box, Vercel Sandbox, Hetzner Cloud, BitQate, and Railway through their APIs.

Requirements

• doctl on your PATH
• At least one authenticated doctl context (doctl auth init)
• API token access to list and manage Droplets and account SSH keys
• A Linux Droplet with a public IPv4 or IPv6 address on port 22
• At least one SSH key on the DigitalOcean account (doctl compute ssh-key list)
• A local private key that matches an account SSH key, or an ssh-agent identity that the Droplet already trusts

Windows Droplets are skipped. Private-only Droplets (no public IP) are skipped; DigitalOcean has no SSH bastion product that Bast can wrap. Powered-off Droplets stay in inventory and are hidden until you press ..

Install and authenticate doctl

Install doctl using the official DigitalOcean instructions, then verify it:

doctl version

Authenticate a context:

doctl auth init

For another team or account:

doctl auth init --context work
doctl auth list

Check the identity behind a context:

doctl account get --context default
doctl compute droplet list --context default

default, work, and similar names are doctl auth contexts. Bast uses them as the second level of the managed host group.

Connect DigitalOcean

1. Open Bast and press 4 for Sync.
2. Select DigitalOcean and press Enter.
3. Choose Connect or Sync now.

By default Bast scans every configured context. Use Context filter or Region filter before syncing when an account is large or a context should stay out of Bast.

Discovery fails closed. If a selected context cannot be scanned, Bast reports an incomplete discovery and keeps that context's previous synced inventory instead of deleting hosts from a partial result.

What gets created

Each Droplet becomes an SSH host under:

~/.ssh/bast/sync/digitalocean/config

The host picker groups Droplets by the doctl context and region used to discover them:

DigitalOcean/<context>/<region>
  droplet-name

For example:

DigitalOcean/default/nyc3
  web-01

Detail shows DigitalOcean synced, or DigitalOcean stopped when the Droplet is powered off. Connection settings, group, and label are read-only. Favoriting and hiding still work. Bast uses the Droplet name as the label.

Powered-off Droplets stay in the inventory and are hidden from the host list until you press .. Enter connects, and powers the Droplet on first when it is off.

Lifecycle

Create defaults: region nyc3, size s-1vcpu-1gb, image ubuntu-24-04-x64. Create fails if the account has no SSH keys.

Shutdown does not pause DigitalOcean billing. Delete the Droplet when you want the disk charge to stop. Fork snapshots are deleted after the new Droplet exists, because snapshots keep billing.

Host keys (Hosts tab)

With the DigitalOcean group selected:

With a DigitalOcean host selected:

How Bast connects

On connect (TUI Enter or bast connect / bast <label>), Bast confirms the Droplet, powers it on when it is off, refreshes its public address, prepares SSH authentication, then launches your system ssh.

DigitalOcean embeds selected account SSH keys into root at Droplet creation. Those keys cannot be added or removed on an existing Droplet through the API. Bast does not modify Droplets, publish keys, or wrap doctl compute ssh.

Bast matches account keys from doctl compute ssh-key list against .pub files under:

~/.ssh/bast/keys
~/.ssh

The matching private key must exist beside its .pub file. If none match, connect still works when the Droplet already trusts a key in your agent.

The default SSH user is root. Fedora CoreOS and Flatcar use core; FreeBSD uses freebsd. Set Default SSH user in the DigitalOcean submenu to override.

DigitalOcean settings

Inside the DigitalOcean submenu:

Press Esc to return to the provider list.

CLI

bast sync digitalocean
bast sync do
bast sync status
bast sync disable digitalocean
bast sync digitalocean --json
bast sync status --json

bast digitalocean new web-01 [--region nyc3] [--size s-1vcpu-1gb] [--image ubuntu-24-04-x64] [--context name]
bast digitalocean fork <host|id>
bast digitalocean stop <host|id>
bast digitalocean resume <host|id>
bast digitalocean delete <host|id> [--yes]
bast do new web-01

bast connect do_default_nyc3_web-01

bast do is an alias for bast digitalocean.

Re-sync and cleanup

Press r on the Sync tab (or run bast sync digitalocean) after creating, deleting, rebuilding, or renaming Droplets outside Bast. Disconnecting DigitalOcean removes the generated sync config and its Include line. It does not affect Bast-managed hosts, Droplets, firewalls, snapshots, or doctl credentials.

Bast does not assign reserved IPs, change firewalls, or read ~/.config/doctl/config.yaml.

Troubleshooting