f5cd320433
Initial documentation of the hubris Proxmox homelab as a cross-linked markdown wiki. Per-node pages, cross-cutting infrastructure pages, an investigation log, and an operations cheatsheet. Each node and topic ends with a Changelog section so changes can be tracked in-place going forward. Refreshed against live state on 2026-04-28 — 14 active LXCs (109 syncthing currently stopped) + 1 VM (108 haos). Reflects post-A/B-test state of the 2026-04-21 hubris crash-loop investigation.
46 lines
2.4 KiB
Markdown
46 lines
2.4 KiB
Markdown
# SSH access
|
|
|
|
How to reach hubris and the VPS over SSH, and the dual-server gotcha.
|
|
|
|
## Hubris
|
|
|
|
Two SSH endpoints — easy to hit the wrong one.
|
|
|
|
| Server | Listen | Auth | Notes |
|
|
| -------------- | ---------------------------- | --------------------------------- | ----- |
|
|
| OpenSSH | `0.0.0.0:22` | `authorized_keys` at `/etc/pve/priv/authorized_keys` (Proxmox cluster-synced; symlinked from `/root/.ssh/authorized_keys`) | Standard. |
|
|
| Netbird SSH | `100.122.38.109:22022` | OIDC / browser auth — bypasses `authorized_keys` | If a client lands here it'll open a browser tab to authenticate, then sometimes hang. Force port 22 or use the LAN IP. |
|
|
|
|
### Authorized root keys
|
|
- `root@hubris` (self, RSA) — original.
|
|
- `d.toro.v@pm.me` (ed25519) — user's iMac (`mac-mini.netbird.selfhosted`, LAN `192.168.8.174`), added 2026-04-22.
|
|
|
|
### Notes
|
|
- Password auth is enabled on hubris but the root password is **not** the one the user expects. Prefer key flows; don't try `ssh-copy-id` blind.
|
|
- Off-LAN access from the iMac uses the LAN path. As of 2026-04-22 the iMac's Netbird tunnel to hubris was P2P healthy but no packets were captured on `wt0`; needs revisit if remote access becomes critical.
|
|
|
|
## VPS (`82.165.190.79` / `100.122.165.149`)
|
|
|
|
- **Mesh-only.** Public `:22` is dropped by the nftables firewall. SSH reaches the VPS only over `wt0`.
|
|
- Key-only (`PasswordAuthentication no`, `PermitRootLogin prohibit-password`) via drop-in at `/etc/ssh/sshd_config.d/10-hubris-hardening.conf`. Original config backed up at `/etc/ssh/sshd_config.bak.<ts>`.
|
|
- `ListenAddress` is still 0.0.0.0; gating is firewall-layer.
|
|
- Authorized root keys: PVE (`root@hubris`), iMac (`d.toro.v@pm.me`). Add a new device with `ssh-copy-id root@100.122.165.149` from a mesh peer before disabling its access paths.
|
|
|
|
See [VPS hardening](vps-hardening.md) for the firewall + fail2ban rules and recovery paths.
|
|
|
|
## Related
|
|
- [Hubris host](../hosts/hubris.md)
|
|
- [Mesh migration](mesh.md)
|
|
- [VPS hardening](vps-hardening.md)
|
|
|
|
## Changelog
|
|
|
|
### 2026-04-28 — wiki entry created
|
|
Initial documentation.
|
|
|
|
### 2026-04-23 — VPS SSH hardened to mesh-only
|
|
Public `:22` blocked at nftables. Key-only sshd. See [VPS hardening](vps-hardening.md).
|
|
|
|
### 2026-04-22 — iMac key authorized on hubris
|
|
`d.toro.v@pm.me` added to `/etc/pve/priv/authorized_keys`.
|