62 lines
2.6 KiB
Markdown
62 lines
2.6 KiB
Markdown
# SSH Mesh — Key-Based Authentication Across All Hosts
|
|
|
|
All Tailscale-connected hosts can SSH to each other using ed25519 key authentication.
|
|
No passwords needed.
|
|
|
|
## Participating Hosts
|
|
|
|
| Host | User | Tailscale IP | SSH Port | Key |
|
|
|------|------|-------------|----------|-----|
|
|
| homelab-vm | homelab | 100.67.40.126 | 22 | admin@thevish.io |
|
|
| atlantis | vish | 100.83.230.112 | 60000 | vish@atlantis |
|
|
| calypso | Vish | 100.103.48.78 | 62000 | calypso access |
|
|
| guava | vish | 100.75.252.64 | 22 | vish@guava |
|
|
| setillo | vish | 100.125.0.20 | 22 | setillo-key |
|
|
| pi-5 | vish | 100.77.151.40 | 22 | vish@pi-5 |
|
|
| nuc | vish | 100.72.55.21 | 22 | vish@nuc |
|
|
| moon | vish | 100.64.0.6 | 22 | vish@moon |
|
|
| seattle | root | 100.82.197.124 | 22 | root@seattle |
|
|
| matrix-ubuntu | test | 100.85.21.51 | 22 | test@matrix-ubuntu |
|
|
| jellyfish | lulu | 100.69.121.120 | 22 | lulu@jellyfish |
|
|
| pve | root | 100.87.12.28 | 22 | root@pve (RSA) |
|
|
| gl-mt3000 | root | 100.126.243.15 | 22 | (admin key only) |
|
|
| gl-be3600 | root | 100.105.59.123 | 22 | root@gl-be3600 |
|
|
|
|
The **admin key** (`admin@thevish.io` from homelab-vm) is present on every host.
|
|
|
|
## Ansible Playbook
|
|
|
|
Manage the mesh with `ansible/playbooks/ssh_mesh.yml`:
|
|
|
|
```bash
|
|
# Distribute keys to all hosts (collect + push)
|
|
ansible-playbook -i inventory.yml playbooks/ssh_mesh.yml --tags distribute
|
|
|
|
# Verify connectivity from localhost
|
|
ansible-playbook -i inventory.yml playbooks/ssh_mesh.yml --tags verify
|
|
|
|
# Generate missing keys + distribute
|
|
ansible-playbook -i inventory.yml playbooks/ssh_mesh.yml -e "generate_missing=true"
|
|
```
|
|
|
|
The `ssh_mesh` group in `inventory.yml` defines which hosts participate.
|
|
|
|
## Adding a New Host
|
|
|
|
1. Add the host to `ansible/inventory.yml` under the appropriate group and to the `ssh_mesh` children
|
|
2. Run the playbook with key generation:
|
|
```bash
|
|
ansible-playbook -i inventory.yml playbooks/ssh_mesh.yml -e "generate_missing=true"
|
|
```
|
|
3. This will generate a key on the new host if needed, collect all keys, and distribute them everywhere
|
|
|
|
## Notes
|
|
|
|
- **Synology NAS (Atlantis/Calypso/Setillo)**: Home directory must be `chmod 755` or stricter — SSH refuses key auth if home is world-writable. DSM can reset permissions on reboot.
|
|
- **OpenWrt routers (MT3000/BE3600)**: Use dropbear SSH, not OpenSSH. Key auth works but `ssh -o` flags differ slightly.
|
|
- **TrueNAS (Guava)**: Home directory is at `/mnt/data/vish-home/vish/`, not `/home/vish/`.
|
|
- **pi-5-kevin**: Frequently offline — will fail verification but has keys distributed.
|
|
- **homelab-vm**: SSH config historically uses password auth to itself; key auth works to all other hosts.
|
|
|
|
## Established 2026-03-23
|