Documentation
¶
Overview ¶
Package sshx is the DevHub's outbound SSH client (S47). The DevHub on the dev box dials OUT to registered servers — Miguel keeps his single laptop→devbox tunnel; no inbound ports are opened anywhere.
Security invariants (non-negotiable):
- Private keys are referenced by filesystem path only; key material never reaches SQLite, API responses or logs.
- Host keys are TOFU: pinned on first connect (persisted by the caller via OnHostKey) and strictly verified afterwards. A changed host key is an explicit error — never InsecureIgnoreHostKey, never silent continue.
- Callers run FIXED commands with validated arguments; nothing here ever receives a command string originating from the UI.
Index ¶
- func Close(serverID int64)
- func Dial(s *Server) (*ssh.Client, error)
- func Forward(s *Server, remotePort int) (net.Listener, error)
- func ForwardAddr(s *Server, remotePort int) (addr string, closer io.Closer, err error)
- func Push(s *Server, localPath, remotePath string) error
- type RunResult
- type Server
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Close ¶
func Close(serverID int64)
Close drops the pooled connection for a server (e.g. when it is deleted from the registry).
func Dial ¶
Dial returns a live SSH client for the server, reusing the pooled connection when it is still alive and reconnecting when it is not.
func Forward ¶
Forward opens an ephemeral local listener that tunnels every connection to 127.0.0.1:remotePort on the server (scraping /metrics, smoke checks — no remote ports get exposed). The caller must Close() the listener. For local servers it returns a direct listener-less address via ForwardAddr instead; callers that may handle local servers should use ForwardAddr.
func ForwardAddr ¶
ForwardAddr returns a "host:port" address reaching the server's remotePort: localhost directly for local servers, an SSH tunnel otherwise. closer is non-nil only when a tunnel was opened.
Types ¶
type Server ¶
type Server struct {
ID int64
Name string
Host string
Port int
User string
KeyPath string
// HostKey is the pinned public host key in authorized_keys format, empty
// until the first successful connect.
HostKey string
// OnHostKey persists a newly-pinned host key (TOFU first connect). May be
// nil, in which case the key is pinned for this process only.
OnHostKey func(authorizedKey string) error
}
Server is the connection identity of a registered server. The api layer loads it from SQLite and persists TOFU host keys via OnHostKey.
Source Files