j3d1/webvirtcloud
1
0
Fork 0
mirror of https://github.com/retspen/webvirtcloud synced 2026-11-08 11:16:47 +00:00
Code Issues Projects Releases Wiki Activity

docs: SSH key setup commands that work in the Docker container

Browse source 
The README gave host commands (sudo, ~www-data) and one sentence for
Docker, where there is no sudo and exec runs as root: a key made that way
lands in /root/.ssh, which the panel (www-data) does not use, and the
first connection fails with "Host key verification failed". Docker now
has its own commands, run as www-data, ending with a connection check.
Both variants accept a new host key once (accept-new) instead of
disabling host key checking.
This commit is contained in:
catborise 2026-10-08 10:56:35 +03:00
parent 69ac3134a5
commit bed4903ac6
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
README.md
View file

@ -235,20 +235,26 @@ A compute node is a KVM host the panel manages over libvirt.
# or, from a cloned repository: sudo sh ./dev/libvirt-bootstrap.sh
```
2. On the panel host, give the web service user (`www-data` on Debian/Ubuntu, `nginx` on RHEL/openSUSE) an SSH key and copy it to the compute node:
2. For SSH connections, give the user the panel runs as an SSH key and copy it to the compute node. `ssh-copy-id` asks for the compute node's root password once. `accept-new` accepts a new host's key on first connect and refuses a changed one.
Installer or manual installation, on the panel host (`www-data` on Debian/Ubuntu, `nginx` on RHEL/openSUSE):
```bash
sudo install -d -m 700 -o www-data -g www-data ~www-data/.ssh
sudo -u www-data ssh-keygen -t ed25519
sudo -u www-data tee ~www-data/.ssh/config > /dev/null << 'EOF'
Host *
StrictHostKeyChecking no
EOF
sudo -u www-data ssh-keygen -t ed25519 -N "" -f ~www-data/.ssh/id_ed25519
printf 'Host *\n StrictHostKeyChecking accept-new\n' | sudo -u www-data tee ~www-data/.ssh/config > /dev/null
sudo chmod 600 ~www-data/.ssh/config
sudo -u www-data ssh-copy-id root@<compute-node-ip>
```
In Docker, run the `ssh-keygen` and `ssh-copy-id` commands inside the container instead (`docker compose exec --user www-data webvirtcloud ssh-keygen -t ed25519`, and the same for `ssh-copy-id`); the keys are kept in the `webvirtcloud-ssh` volume.
Docker, from the directory with `docker-compose.yml` (always as `www-data`: the keys are kept in the `webvirtcloud-ssh` volume, and a key made as root is not used by the panel):
```bash
docker compose exec -u www-data webvirtcloud ssh-keygen -t ed25519 -N "" -f /var/www/.ssh/id_ed25519
docker compose exec -u www-data webvirtcloud sh -c 'printf "Host *\n StrictHostKeyChecking accept-new\n" > ~/.ssh/config && chmod 600 ~/.ssh/config'
docker compose exec -u www-data webvirtcloud ssh-copy-id root@<compute-node-ip>
docker compose exec -u www-data webvirtcloud ssh root@<compute-node-ip> true # no password or prompt: ready
```
3. Install or update the `gstfsd` daemon on the compute node. It sets the root password and SSH key of a shut-off VM: