feat(pods): SSH agent forwarding → git push from your pod with your key#53
Merged
Conversation
Code in your pod and push to git.profullstack.com using the SAME SSH key you signed in with — nothing is copied into the pod. When a member attaches with agent forwarding (ssh -A), agentbbs listens on a fresh unix socket in a per-user agent dir bind-mounted at /run/agentbbs-agent and proxies it back over the session; the pod shell gets SSH_AUTH_SOCK pointed at it. The pod image's ssh_config sends git@git.profullstack.com to Forgejo's SSH server (:2222), so `git clone git@git.profullstack.com:you/repo.git` just works. - pods.go: agentDir + startAgent (per-session socket, cleaned up on exit); Attach injects SSH_AUTH_SOCK when ssh.AgentRequested; ensure() bind-mounts the agent dir and self-heals idle pods missing it. No main.go change needed — charmbracelet/ssh sets AgentRequested from the session request loop. - pods/Containerfile: /etc/ssh/ssh_config.d entry (port 2222, user git, accept-new) so the conventional git@ URL reaches Forgejo. - setup.sh: keep using an already-built pod image if a later rebuild transient-fails, so a flaky deploy never downgrades pods to the base image. Build/vet/test/gofmt clean. Image rebuilt on the host; `ssh -G git.profullstack.com` resolves to port 2222 / user git. End-to-end push needs a live `ssh -A` session (validate after deploy). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
vu1nz Security Review0 finding(s) in PR #? No security issues found. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Closes the loop on "all auth uses our SSH keys": code in your pod (Claude Code / Codex from #51) and push to git.profullstack.com using the same key you signed in with — nothing is copied into the pod.
When a member attaches with agent forwarding (
ssh -A NAME@bbs.profullstack.com→ Pod), agentbbs listens on a fresh unix socket in a per-user agent dir bind-mounted into the pod at/run/agentbbs-agent, proxies it back over the SSH session, and points the pod shell'sSSH_AUTH_SOCKat it. The pod image'sssh_configroutesgit@git.profullstack.comto Forgejo's SSH server on:2222.So inside the pod:
Changes
internal/pods/pods.go—agentDir+startAgent(per-session socket, cleaned up on session exit);AttachinjectsSSH_AUTH_SOCKwhenssh.AgentRequested;ensure()bind-mounts the agent dir and self-heals idle pods missing it. Nomain.gochange — charmbracelet/ssh setsAgentRequestedfrom the session request loop.pods/Containerfile—/etc/ssh/ssh_config.d/10-agentgit.conf(port 2222, user git,accept-new).setup.sh— if a pod-image rebuild transient-fails but an image already exists, keep using it (so a flaky deploy never downgrades pods to the base image — which just happened on the feat(web): rich landing page — BBS history + all commands #52 deploy).Verified
Build/vet/test/gofmt clean. Image rebuilt on the host;
ssh -G git.profullstack.cominside it →port 2222 / user git. End-to-end push needs a livessh -Asession (a real client with a loaded agent) — validate after this deploys. Built on #50/#51 (already merged).🤖 Generated with Claude Code