From 6961ff2280184af019a2454480055f8e0dca17b9 Mon Sep 17 00:00:00 2001 From: catborise Date: Thu, 8 Oct 2026 13:26:07 +0300 Subject: [PATCH] docs: SSH key setup that names the panel user per platform The host commands hard-coded www-data, which does not exist on RHEL and openSUSE (the panel runs as nginx there), so the first command failed with "invalid user". The user is now set once in U and its home is read with getent, since ~$U is not expanded. The host block also ends with the same connection check as the Docker one. Both blocks are labelled, and the step says to use only the one for the installation type: a key set up on the host is not seen by the panel in Docker. AGENTS.md is a local agent file and is ignored. --- .gitignore | 1 + README.md | 19 +++++++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) diff --git a/.gitignore b/.gitignore index 0a2cf02b..873a8083 100644 --- a/.gitignore +++ b/.gitignore @@ -17,6 +17,7 @@ htmlcov *.log templates/webvirtcloud.code-workspace DEPENDENCY_UPGRADE_PLAN.md +AGENTS.md ROADMAP.md .agents diff --git a/README.md b/README.md index c20b9d02..ce54cc61 100644 --- a/README.md +++ b/README.md @@ -235,19 +235,22 @@ A compute node is a KVM host the panel manages over libvirt. # or, from a cloned repository: sudo sh ./dev/libvirt-bootstrap.sh ``` -2. For SSH connections, give the user the panel runs as an SSH key and copy it to the compute node. `ssh-copy-id` asks for the compute node's root password once. `accept-new` accepts a new host's key on first connect and refuses a changed one. +2. For SSH connections, give the user the panel runs as an SSH key and copy it to the compute node. **Use only the block for your installation type:** a key set up with the host commands is not seen by the panel in Docker. `ssh-copy-id` asks for the compute node's root password once. `accept-new` accepts a new host's key on first connect and refuses a changed one. - Installer or manual installation, on the panel host (`www-data` on Debian/Ubuntu, `nginx` on RHEL/openSUSE): + **Installer or manual installation**, on the panel host: ```bash - sudo install -d -m 700 -o www-data -g www-data ~www-data/.ssh - sudo -u www-data ssh-keygen -t ed25519 -N "" -f ~www-data/.ssh/id_ed25519 - printf 'Host *\n StrictHostKeyChecking accept-new\n' | sudo -u www-data tee ~www-data/.ssh/config > /dev/null - sudo chmod 600 ~www-data/.ssh/config - sudo -u www-data ssh-copy-id root@ + U=www-data # the web service user: www-data on Debian/Ubuntu, nginx on RHEL/openSUSE + H=$(getent passwd $U | cut -d: -f6) + sudo install -d -m 700 -o $U -g $U $H/.ssh + sudo -u $U ssh-keygen -t ed25519 -N "" -f $H/.ssh/id_ed25519 + printf 'Host *\n StrictHostKeyChecking accept-new\n' | sudo -u $U tee $H/.ssh/config > /dev/null + sudo chmod 600 $H/.ssh/config + sudo -u $U ssh-copy-id root@ + sudo -u $U ssh root@ true # no password or prompt: ready ``` - Docker, from the directory with `docker-compose.yml` (always as `www-data`: the keys are kept in the `webvirtcloud-ssh` volume, and a key made as root is not used by the panel): + **Docker**, on the Docker host from the directory with `docker-compose.yml`; the commands run inside the container (always as `www-data`: the keys are kept in the `webvirtcloud-ssh` volume, and a key made as root is not used by the panel): ```bash docker compose exec -u www-data webvirtcloud ssh-keygen -t ed25519 -N "" -f /var/www/.ssh/id_ed25519