Documentation
¶
Overview ¶
SSH host entries parse from a pasted ssh command restricted to connection options and allowlisted directives, and render to one OpenSSH stanza. The parsed value is both the wire shape and the stored payload. An SSH host's only credential is the stored key its keyId names, so the command takes no -i and no identity option; the key's path is supplied at render time and never stored or returned.
SSH key handling validates names and private-key material before writing metadata and protected bytes. A staged filename binds an interrupted write to committed metadata so startup can promote or discard it without reading key contents. API responses expose only public metadata; deletion also clears SSH host references and rerenders config.
SSH host persistence coordinates SQL metadata with rendered per-principal config and protected key files. SSH host and key tables remain private to this subsystem; a process-wide database lock encloses each compensated flow, and only its metadata mutation runs in a transaction. Queries in query.sql are generated into query.sql.go by sqlc. The real OpenSSH config is never read or changed.
Package ssh owns principal-scoped SSH hosts, keys, rendered configuration, live probes, and authentication. The database stores SSH host and key metadata while private keys and generated configs remain protected files. SSH host and key mutations coordinate database, config, and file effects as compensated flows; OpenSSH execution and control-master mechanics remain in internal/ssh. Health only opens a TCP connection to the first hop, and only to public addresses, so it cannot probe cs-plane's own network.
Index ¶
- Variables
- func SubprotocolAuthRoute(request *http.Request) bool
- type AddHostRequest
- type DBTX
- type DeleteHostParams
- type DeleteKeyParams
- type GetKeyParams
- type GetKeyRow
- type HostEntry
- type HostHealth
- type HostList
- type InsertHostParams
- type InsertKeyParams
- type ListHostsRow
- type ListKeysRow
- type Queries
- func (q *Queries) DeleteHost(ctx context.Context, arg DeleteHostParams) (int64, error)
- func (q *Queries) DeleteKey(ctx context.Context, arg DeleteKeyParams) (int64, error)
- func (q *Queries) GetKey(ctx context.Context, arg GetKeyParams) (GetKeyRow, error)
- func (q *Queries) InsertHost(ctx context.Context, arg InsertHostParams) error
- func (q *Queries) InsertKey(ctx context.Context, arg InsertKeyParams) error
- func (q *Queries) ListHostPrincipals(ctx context.Context) ([]string, error)
- func (q *Queries) ListHosts(ctx context.Context, principal string) ([]ListHostsRow, error)
- func (q *Queries) ListKeys(ctx context.Context, principal string) ([]ListKeysRow, error)
- func (q *Queries) UpdateHost(ctx context.Context, arg UpdateHostParams) (int64, error)
- func (q *Queries) WithTx(tx *sql.Tx) *Queries
- type SSHKey
- type SSHKeyList
- type SSHKeyRequest
- type Service
- type Store
- type UpdateHostParams
- type UpdateHostRequest
Constants ¶
This section is empty.
Variables ¶
var Schema string
Functions ¶
func SubprotocolAuthRoute ¶ added in v0.4.2
SubprotocolAuthRoute reports the SSH authentication WebSocket, whose browser client offers its bearer as a subprotocol.
Types ¶
type AddHostRequest ¶
type DeleteHostParams ¶
type DeleteKeyParams ¶
type GetKeyParams ¶
type HostHealth ¶
type InsertHostParams ¶
type InsertKeyParams ¶
type ListHostsRow ¶
type ListKeysRow ¶
type Queries ¶
type Queries struct {
// contains filtered or unexported fields
}
func (*Queries) DeleteHost ¶
func (*Queries) InsertHost ¶
func (q *Queries) InsertHost(ctx context.Context, arg InsertHostParams) error
func (*Queries) InsertKey ¶
func (q *Queries) InsertKey(ctx context.Context, arg InsertKeyParams) error
func (*Queries) ListHostPrincipals ¶
func (*Queries) UpdateHost ¶
type SSHKeyList ¶
type SSHKeyList struct {
Keys []SSHKey `json:"keys"`
}
type SSHKeyRequest ¶
type Service ¶
type Service struct {
Store Store
Configs internalssh.Configurations
Control *internalssh.ControlManager
}
func NewService ¶
func NewService(database *db.DB, configs internalssh.Configurations, control *internalssh.ControlManager) (*Service, error)