Sanitized mirror from private repository - 2026-03-30 09:47:37 UTC
This commit is contained in:
Gitea Mirror Bot
251
docs/infrastructure/SSH_ACCESS_GUIDE.md
Normal file
251
docs/infrastructure/SSH_ACCESS_GUIDE.md
Normal file
@@ -0,0 +1,251 @@
|
||||
# SSH Access Guide for Homelab
|
||||
|
||||
This guide documents the actual SSH configuration used to access all homelab hosts. All access goes through the **Tailscale mesh network** (`tail.vish.gg` MagicDNS suffix). There is no direct LAN SSH — all hosts are accessed via their Tailscale IPs.
|
||||
|
||||
## Network Overview
|
||||
|
||||
- **Mesh network**: Tailscale / Headscale (`headscale.vish.gg:8443`)
|
||||
- **MagicDNS suffix**: `tail.vish.gg`
|
||||
- **SSH key**: `~/.ssh/id_ed25519` (default key, no IdentityFile needed in config)
|
||||
- **Config location**: `~/.ssh/config` on homelab VM
|
||||
|
||||
---
|
||||
|
||||
## SSH Config (`~/.ssh/config`)
|
||||
|
||||
The full working SSH config on the homelab VM:
|
||||
|
||||
```
|
||||
# Atlantis - Primary Synology NAS (DS1821+)
|
||||
Host atlantis
|
||||
HostName 100.83.230.112
|
||||
User vish
|
||||
Port 60000
|
||||
|
||||
# Calypso - Secondary Synology NAS (DS723+)
|
||||
Host calypso
|
||||
HostName 100.103.48.78
|
||||
User Vish
|
||||
Port 62000
|
||||
|
||||
# Homelab VM
|
||||
Host homelab
|
||||
HostName 100.67.40.126
|
||||
User homelab
|
||||
# Note: password authentication only (no key auth configured on this host)
|
||||
|
||||
# Proxmox VE host
|
||||
Host pve
|
||||
HostName 100.87.12.28
|
||||
User root
|
||||
|
||||
# Concord NUC (Intel NUC)
|
||||
Host vish-concord-nuc
|
||||
Host concord
|
||||
Host nuc
|
||||
HostName 100.72.55.21
|
||||
User vish
|
||||
|
||||
# TrueNAS Scale (Guava)
|
||||
Host guava
|
||||
Host truenas
|
||||
HostName 100.75.252.64
|
||||
User vish
|
||||
|
||||
# Raspberry Pi 5
|
||||
Host pi-5
|
||||
HostName 100.77.151.40
|
||||
User vish
|
||||
|
||||
# Setillo (Proxmox LXC / container)
|
||||
Host setillo
|
||||
HostName 100.125.0.20
|
||||
User vish
|
||||
|
||||
Host setillo-root
|
||||
HostName 100.125.0.20
|
||||
User root
|
||||
|
||||
# Jellyfish (GL-MT3000 LAN device)
|
||||
Host jellyfish
|
||||
HostName 100.69.121.120
|
||||
User lulu
|
||||
|
||||
# Home Assistant OS
|
||||
Host homeassistant
|
||||
HostName 100.112.186.90
|
||||
User hassio
|
||||
Port 22
|
||||
|
||||
# GL-MT3000 (Beryl AX - IoT/HA gateway router)
|
||||
Host gl-mt3000
|
||||
HostName 100.126.243.15
|
||||
User root
|
||||
|
||||
# GL-BE3600 (Slate 7 - travel/repeater router)
|
||||
Host gl-be3600
|
||||
HostName 100.105.59.123
|
||||
User root
|
||||
|
||||
# mastodon-rocky (Rocky Linux 10 VM - Mastodon)
|
||||
Host mastodon-rocky
|
||||
HostName 100.64.0.3
|
||||
User root
|
||||
|
||||
# vishdebian (Debian 13 Trixie desktop)
|
||||
Host vishdebian
|
||||
HostName 100.64.0.2
|
||||
User vish
|
||||
|
||||
# shinku-ryuu (Windows desktop)
|
||||
Host shinku-ryuu
|
||||
HostName 100.98.93.15
|
||||
User vish
|
||||
|
||||
# Seattle VPS
|
||||
Host seattle
|
||||
Host seattle-tailscale
|
||||
HostName <seattle-tailscale-ip>
|
||||
User root
|
||||
|
||||
# Laptop (offline when sleeping)
|
||||
Host laptop
|
||||
HostName 100.124.91.52
|
||||
User vish
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Host Reference
|
||||
|
||||
| Alias(es) | Tailscale IP | User | Port | Host |
|
||||
|-----------|-------------|------|------|------|
|
||||
| `atlantis` | 100.83.230.112 | vish | 60000 | Synology DS1821+ |
|
||||
| `calypso` | 100.103.48.78 | Vish | 62000 | Synology DS723+ |
|
||||
| `homelab` | 100.67.40.126 | homelab | 22 | Homelab VM (password auth) |
|
||||
| `pve` | 100.87.12.28 | root | 22 | Proxmox VE |
|
||||
| `concord`, `nuc`, `vish-concord-nuc` | 100.72.55.21 | vish | 22 | Intel NUC |
|
||||
| `guava`, `truenas` | 100.75.252.64 | vish | 22 | TrueNAS Scale |
|
||||
| `pi-5` | 100.77.151.40 | vish | 22 | Raspberry Pi 5 |
|
||||
| `setillo` | 100.125.0.20 | vish | 22 | Proxmox LXC container |
|
||||
| `setillo-root` | 100.125.0.20 | root | 22 | Proxmox LXC container (root) |
|
||||
| `jellyfish` | 100.69.121.120 | lulu | 22 | Device on GL-MT3000 LAN |
|
||||
| `homeassistant` | 100.112.186.90 | hassio | 22 | Home Assistant OS |
|
||||
| `gl-mt3000` | 100.126.243.15 | root | 22 | GL-MT3000 router (dropbear) |
|
||||
| `gl-be3600` | 100.105.59.123 | root | 22 | GL-BE3600 router (dropbear) |
|
||||
| `vishdebian` | 100.64.0.2 | vish | 22 | Debian 13 Trixie desktop |
|
||||
| `mastodon-rocky` | 100.64.0.3 | root | 22 | Rocky Linux 10 VM (Mastodon) |
|
||||
| `shinku-ryuu` | 100.98.93.15 | vish | 22 | Windows desktop (Win32-OpenSSH) |
|
||||
| `laptop` | 100.124.91.52 | vish | 22 | Laptop (offline when sleeping) |
|
||||
|
||||
---
|
||||
|
||||
## Special Notes Per Host
|
||||
|
||||
### Atlantis & Calypso (Synology)
|
||||
- SSH port is non-standard (60000 / 62000) — configured in DSM → Terminal & SNMP
|
||||
- Synology Docker is at `/usr/local/bin/docker`, requires `sudo`
|
||||
- `User` is case-sensitive: `vish` on Atlantis, `Vish` (capital V) on Calypso
|
||||
|
||||
### homelab VM
|
||||
- **Password authentication only** — no SSH key installed on this host
|
||||
- Auth: password (same as the username) # pragma: allowlist secret
|
||||
|
||||
### pve (Proxmox)
|
||||
- Root login; key-based auth
|
||||
- To access containers: `ssh pve "pct exec <CTID> -- <command>"`
|
||||
|
||||
### GL-MT3000
|
||||
- Uses **dropbear** SSH (not OpenSSH) — no `/etc/ssh/sshd_config`
|
||||
- Authorized keys: `/etc/dropbear/authorized_keys`
|
||||
- Is the **gateway for jellyfish and Home Assistant** (LAN: `192.168.12.0/24`)
|
||||
- Advertises subnet route `192.168.12.0/24` via Headscale
|
||||
- Tailscale version: `1.92.5-tiny` (GL-inet custom build)
|
||||
|
||||
### GL-BE3600
|
||||
- Uses **dropbear** SSH (not OpenSSH)
|
||||
- Authorized keys: `/etc/dropbear/authorized_keys`
|
||||
- Acts as a **Wi-Fi repeater** on the home network (management: `192.168.68.53`, own LAN: `192.168.8.1`)
|
||||
- Ports are filtered from homelab VM and NUC — only reachable directly via its `192.168.8.x` LAN or Tailscale
|
||||
- Advertises subnet route `192.168.8.0/24` via Headscale
|
||||
- Tailscale version: `1.90.9-tiny` (GL-inet custom build)
|
||||
|
||||
### shinku-ryuu (Windows)
|
||||
- Running **Win32-OpenSSH v10.0.0.0** (installed via MSI from GitHub)
|
||||
- Authorized keys location: `C:\ProgramData\ssh\administrators_authorized_keys`
|
||||
- (NOT `~/.ssh/authorized_keys` — Windows OpenSSH ignores per-user authorized_keys for Administrator group members)
|
||||
- Permissions on that file must be restricted to SYSTEM and Administrators only
|
||||
|
||||
### TrueNAS (guava)
|
||||
- User `vish` is in the `docker` group — no `sudo` needed for Docker commands
|
||||
|
||||
---
|
||||
|
||||
## Headscale Subnet Routes
|
||||
|
||||
All subnet routes are approved via Headscale. Non-overlapping:
|
||||
|
||||
| Node | Subnet | Status |
|
||||
|------|--------|--------|
|
||||
| calypso | 192.168.0.0/24 | Serving (primary) — **advertiser** |
|
||||
| atlantis | 192.168.0.0/24 | Approved, not serving (backup) — **advertiser** |
|
||||
| vish-concord-nuc | 192.168.68.0/22 | Serving |
|
||||
| setillo | 192.168.69.0/24 | Serving |
|
||||
| gl-mt3000 | 192.168.12.0/24 | Serving |
|
||||
| gl-be3600 | 192.168.8.0/24 | Serving |
|
||||
|
||||
To inspect/approve routes:
|
||||
```bash
|
||||
# On Calypso (where Headscale container runs):
|
||||
ssh calypso
|
||||
docker exec headscale headscale nodes list
|
||||
docker exec headscale headscale nodes list-routes --identifier <ID>
|
||||
docker exec headscale headscale nodes approve-routes --identifier <ID> --routes <CIDR>
|
||||
```
|
||||
|
||||
> **Note**: In Headscale v0.28, `--user` takes a numeric ID, not a username. Use `headscale users list` to find IDs.
|
||||
|
||||
---
|
||||
|
||||
## Common SSH Tasks
|
||||
|
||||
```bash
|
||||
# Run a docker command on Atlantis
|
||||
ssh atlantis "sudo /usr/local/bin/docker ps"
|
||||
|
||||
# Run a docker command on Guava (no sudo needed)
|
||||
ssh guava "docker ps"
|
||||
|
||||
# Access a Proxmox LXC container
|
||||
ssh pve "pct exec 103 -- docker ps"
|
||||
|
||||
# Copy a file to Atlantis
|
||||
scp myfile.yaml atlantis:/volume1/docker/
|
||||
|
||||
# Port forward a remote service locally
|
||||
ssh -L 8080:localhost:8080 atlantis
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
```bash
|
||||
# Debug connection
|
||||
ssh -vvv <host>
|
||||
|
||||
# Remove stale host key (after host rebuild)
|
||||
ssh-keygen -R <hostname-or-ip>
|
||||
|
||||
# Fix local permissions
|
||||
chmod 700 ~/.ssh
|
||||
chmod 600 ~/.ssh/config
|
||||
chmod 600 ~/.ssh/authorized_keys
|
||||
chmod 600 ~/.ssh/id_ed25519
|
||||
chmod 644 ~/.ssh/id_ed25519.pub
|
||||
```
|
||||
|
||||
---
|
||||
|
||||
*Last Updated*: 2026-03-10 (added vishdebian, mastodon-rocky)
|
||||
*All hosts accessed via Tailscale mesh — no direct LAN SSH*
|
||||
Reference in New Issue
Block a user