Files

dtoro f5cd320433 Bootstrap Homelab-Docs wiki

Initial documentation of the hubris Proxmox homelab as a cross-linked
markdown wiki. Per-node pages, cross-cutting infrastructure pages, an
investigation log, and an operations cheatsheet. Each node and topic
ends with a Changelog section so changes can be tracked in-place going
forward.

Refreshed against live state on 2026-04-28 — 14 active LXCs (109
syncthing currently stopped) + 1 VM (108 haos). Reflects post-A/B-test
state of the 2026-04-21 hubris crash-loop investigation.

2026-04-28 22:53:09 +02:00

2.4 KiB

Raw Blame History

SSH access

How to reach hubris and the VPS over SSH, and the dual-server gotcha.

Hubris

Two SSH endpoints — easy to hit the wrong one.

Server	Listen	Auth	Notes
OpenSSH	`0.0.0.0:22`	`authorized_keys` at `/etc/pve/priv/authorized_keys` (Proxmox cluster-synced; symlinked from `/root/.ssh/authorized_keys`)	Standard.
Netbird SSH	`100.122.38.109:22022`	OIDC / browser auth — bypasses `authorized_keys`	If a client lands here it'll open a browser tab to authenticate, then sometimes hang. Force port 22 or use the LAN IP.

Authorized root keys

root@hubris (self, RSA) — original.
d.toro.v@pm.me (ed25519) — user's iMac (mac-mini.netbird.selfhosted, LAN 192.168.8.174), added 2026-04-22.

Notes

Password auth is enabled on hubris but the root password is not the one the user expects. Prefer key flows; don't try ssh-copy-id blind.
Off-LAN access from the iMac uses the LAN path. As of 2026-04-22 the iMac's Netbird tunnel to hubris was P2P healthy but no packets were captured on wt0; needs revisit if remote access becomes critical.

VPS (`82.165.190.79` / `100.122.165.149`)

Mesh-only. Public :22 is dropped by the nftables firewall. SSH reaches the VPS only over wt0.
Key-only (PasswordAuthentication no, PermitRootLogin prohibit-password) via drop-in at /etc/ssh/sshd_config.d/10-hubris-hardening.conf. Original config backed up at /etc/ssh/sshd_config.bak.<ts>.
ListenAddress is still 0.0.0.0; gating is firewall-layer.
Authorized root keys: PVE (root@hubris), iMac (d.toro.v@pm.me). Add a new device with ssh-copy-id root@100.122.165.149 from a mesh peer before disabling its access paths.

See VPS hardening for the firewall + fail2ban rules and recovery paths.

Changelog

2026-04-28 — wiki entry created

Initial documentation.

2026-04-23 — VPS SSH hardened to mesh-only

Public :22 blocked at nftables. Key-only sshd. See VPS hardening.

2026-04-22 — iMac key authorized on hubris

d.toro.v@pm.me added to /etc/pve/priv/authorized_keys.

2.4 KiB Raw Blame History