feat(ssh): hosted SSH clone goes live — persistent host key, port published #5509
ccantynzAI Reviewcommented 11d ago
AI Triage
(no summary)
Priority: medium Risk area: mixed
Suggested labels: (no label suggestions) Suggested reviewers: (no reviewer suggestions)
Suggestions only — nothing has been applied. The PR author stays in control.
gluecron[bot]🤖 botAI Reviewcommented 11d ago
AI review unavailable
The platform's AI balance is exhausted, so AI generation is temporarily unavailable. Nothing was lost. You can queue this as a repair for the internal agent from the repository's Health page, or try again once the balance is restored. The PR is otherwise unchanged.
Cross-repo impact
See what breaks downstream if this PR merges.
⮌ Merged
This pull request was merged into main.
c comment · e edit title · m merge · a approve · r request changes · ? shortcuts
Scorecard move #1 of the greenlit 1–6 block
The SSH server (Block SSH-1) has been complete since launch; production pinned
SSH_PORT=0. This flips it on properly:SSH_PORT=2222+ports: "2222:2222"on the gluecron service (SSH is TCP, not HTTP — published directly, not via caddy).SSH_HOST_KEYused to generate a fresh key each restart — every deploy would have greeted every clone with a MITM warning. The generated key now persists toconfig.sshHostKeyFile(default${GIT_REPOS_PATH}/.gluecron/ssh_host_ed25519_key— rides the git-repos volume, mode 0600).SSH_HOST_KEYenv still wins; corrupt files regenerate loudly.hostHas("ssh")flips with the port, lighting the already-built SSH clone tab.Tests: 3 new (env-key precedence + \n normalization, generate-once-reuse across calls incl. nested dir creation, corrupt-file regeneration); ssh-server suite 25/25, host-capabilities parity 20/20, typecheck clean.
Post-deploy verification plan: external TCP probe of gluecron.com:2222, then a real
git clone ssh://git@gluecron.com:2222/...— docker-published ports bypass ufw, but the Vultr cloud firewall may still need 2222 opened (owner console) if the probe fails.🤖 Generated with Claude Code