From bed4903ac69c1995108fc03245ae0ea9cf8521cb Mon Sep 17 00:00:00 2001 From: catborise Date: Thu, 8 Oct 2026 10:56:35 +0300 Subject: [PATCH] docs: SSH key setup commands that work in the Docker container The README gave host commands (sudo, ~www-data) and one sentence for Docker, where there is no sudo and exec runs as root: a key made that way lands in /root/.ssh, which the panel (www-data) does not use, and the first connection fails with "Host key verification failed". Docker now has its own commands, run as www-data, ending with a connection check. Both variants accept a new host key once (accept-new) instead of disabling host key checking. --- README.md | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/README.md b/README.md index 2554cc53..c20b9d02 100644 --- a/README.md +++ b/README.md @@ -235,20 +235,26 @@ A compute node is a KVM host the panel manages over libvirt. # or, from a cloned repository: sudo sh ./dev/libvirt-bootstrap.sh ``` -2. On the panel host, give the web service user (`www-data` on Debian/Ubuntu, `nginx` on RHEL/openSUSE) an SSH key and copy it to the compute node: +2. For SSH connections, give the user the panel runs as an SSH key and copy it to the compute node. `ssh-copy-id` asks for the compute node's root password once. `accept-new` accepts a new host's key on first connect and refuses a changed one. + + Installer or manual installation, on the panel host (`www-data` on Debian/Ubuntu, `nginx` on RHEL/openSUSE): ```bash sudo install -d -m 700 -o www-data -g www-data ~www-data/.ssh - sudo -u www-data ssh-keygen -t ed25519 - sudo -u www-data tee ~www-data/.ssh/config > /dev/null << 'EOF' - Host * - StrictHostKeyChecking no - EOF + sudo -u www-data ssh-keygen -t ed25519 -N "" -f ~www-data/.ssh/id_ed25519 + printf 'Host *\n StrictHostKeyChecking accept-new\n' | sudo -u www-data tee ~www-data/.ssh/config > /dev/null sudo chmod 600 ~www-data/.ssh/config sudo -u www-data ssh-copy-id root@ ``` - In Docker, run the `ssh-keygen` and `ssh-copy-id` commands inside the container instead (`docker compose exec --user www-data webvirtcloud ssh-keygen -t ed25519`, and the same for `ssh-copy-id`); the keys are kept in the `webvirtcloud-ssh` volume. + Docker, from the directory with `docker-compose.yml` (always as `www-data`: the keys are kept in the `webvirtcloud-ssh` volume, and a key made as root is not used by the panel): + + ```bash + docker compose exec -u www-data webvirtcloud ssh-keygen -t ed25519 -N "" -f /var/www/.ssh/id_ed25519 + docker compose exec -u www-data webvirtcloud sh -c 'printf "Host *\n StrictHostKeyChecking accept-new\n" > ~/.ssh/config && chmod 600 ~/.ssh/config' + docker compose exec -u www-data webvirtcloud ssh-copy-id root@ + docker compose exec -u www-data webvirtcloud ssh root@ true # no password or prompt: ready + ``` 3. Install or update the `gstfsd` daemon on the compute node. It sets the root password and SSH key of a shut-off VM: