feat(agentgit): SSH-key auth for git.profullstack.com + push#50
Merged
Conversation
Make git.profullstack.com a real, key-authenticated git host for every BBS
member ("BBS membership is the git account", SSH-key auth end to end):
- forgejo.EnsureKey: register a member's SSH public key on their Forgejo
account (idempotent, ignores the key comment). So the key they sign in to
the BBS with is also their git push key.
- provisionGit now takes the session public key and registers it after
ensuring the account; called on email verification AND (newly) on every
member login, so members who predate AgentGit — or whose key wasn't
registered yet — are backfilled automatically and off the hot path.
- setup.sh:
- admin token scopes write:admin,read:user,write:user (the old write:admin
alone failed userExists' /users lookup, so provisioning never worked).
- REQUIRE_SIGNIN_VIEW=false so member profiles + public repos are viewable
at git.profullstack.com/<name> (private repos stay private; accounts are
still created only by agentbbs).
- Enable Forgejo's built-in SSH server (port 2222, BUILTIN_SSH_SERVER_USER=git)
and open the firewall, so members push to git@git.profullstack.com:2222.
Verified live: all members provisioned, git.profullstack.com/chovy serves the
profile, and a push over ssh://git@host:2222 with a registered key succeeds.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Turns
git.profullstack.cominto a working, SSH-key-authenticated git host for every BBS member — "all permissions and auth use our SSH keys."Why it was broken
write:admin, butuserExistscalls/users/{name}which needsread:user— so provisioning failed on the first call and no members ever got accounts.EnsureUsercreated accounts but never registered the member's SSH key, and Forgejo had SSH disabled — so there was no way to push.REQUIRE_SIGNIN_VIEW=truehid member profiles from anonymous visitors.Changes
forgejo.EnsureKey— idempotently register a member's SSH public key on their Forgejo account (compares key material, ignoring the comment). New tests.provisionGit(u, pubKey)— ensure account and register the session's SSH key; now also called on every member login (goroutine, off the hot path) to backfill members who predate AgentGit.write:admin,read:user,write:userREQUIRE_SIGNIN_VIEW=false(public profiles + public repos; private stay private; accounts only created by agentbbs)port 2222,BUILTIN_SSH_SERVER_USER=git,ufw allow 2222Verified live on bbs.profullstack.com
git.profullstack.com/chovyserves the profile (HTTP 200).git push ssh://git@host:2222/chovy/repo.gitwith a registered key succeeds (* [new branch] main -> main). Test artifacts cleaned up.Follow-up (separate PR)
Pod image with Node + Claude Code + Codex, and seamless pod→git push using the member's key (so they can code in the pod and push). Tracked next.
🤖 Generated with Claude Code