VersionControl:PRs/maybelle-config/280 - Revision history

DrivingThatTrain: cryptograss/maybelle-config#280, as GitHub has it

2026-11-09T17:06:22Z

cryptograss/maybelle-config#280, as GitHub has it

← Older revision		Revision as of 17:06, 9 November 2026
Line 16:		Line 16:
	\|deploy=redeploy maybelle (the fix); hunter at its next deploy (cosmetic)		\|deploy=redeploy maybelle (the fix); hunter at its next deploy (cosmetic)
	}}		}}
			<pre class="pr-body">githouse's first deploy (#250, maybelle 6 Nov 05:08Z, hunter 05:22Z) had everything in place except the door: the relayed keys arrived on maybelle, `authorized_keys` had four lines by 05:23Z, and every push and the mirror's fetch still got `Permission denied (publickey)`.

			Cause: `useradd` leaves the `git` account's password field as `!`, which sshd reads as a locked account and refuses even by key. sshd logged to syslog inside the container, so `docker logs githouse` showed nothing, and the deploy's wait for `branches.json` passed because `init` writes that file too.

			Reproduced and fixed in a throwaway container on hunter (`githouse-test` and `githouse-locked`, both removed after): the deployed image's state, with the account locked, gave `User git not allowed because account is locked`; the fixed image accepted the same key, ran the forced command (`githouse: only git fetch and git push here`), and `git ls-remote` through it reached `auth` (`no repository nothing here`).

			Changes:
			- `Dockerfile`: `usermod -p '*' git`. An unusable password, not a locked one. The standard git-server fix.
			- `entrypoint.sh`: `sshd -D -e &`, so its log goes to stderr and `docker logs githouse` says why a key was refused.
			- `githouse.py`: the keys are rebuilt each round before the fetches, repositories or none (before, no repositories meant no `authorized_keys` ever).
			- `container_startup.py`: magent's key is published from `emergent-magent` only. The `magent` unix user exists in every container, so each had been publishing a `magent.pub` beside its own emergent's key; maybelle ignored them, but the relay should carry one key per name.

			Tests: `test_githouse.py` 17, `test_container_startup.py` 36 (one extended: the key is made but not published where `publish=False`). Both pass. render-diff is clean against production.

			Deploy: redeploy maybelle (the fix); hunter at its next deploy (cosmetic)
			Worked on by: magent, Justin, re, in #ramp</pre>

DrivingThatTrain: cryptograss/maybelle-config#280, as GitHub has it

2026-11-06T05:36:07Z

cryptograss/maybelle-config#280, as GitHub has it

← Older revision		Revision as of 05:36, 6 November 2026
Line 5:		Line 5:
	\|url=https://github.com/cryptograss/maybelle-config/pull/280		\|url=https://github.com/cryptograss/maybelle-config/pull/280
	\|author=magent-cryptograss		\|author=magent-cryptograss
	\|state=~~open~~		\|state=merged
	\|base=production		\|base=production
	\|branch=magent/githouse-unlock		\|branch=magent/githouse-unlock
	\|opened=2026-11-06 05:33:11		\|opened=2026-11-06 05:33:11
	\|pushed=2026-11-06 05:32:20		\|pushed=2026-11-06 05:32:20
	\|merged=		\|merged=2026-11-06 05:36:03
	\|closed=		\|closed=
	\|worked_on_by=magent, justin, re		\|worked_on_by=magent, justin, re

DrivingThatTrain: cryptograss/maybelle-config#280, as GitHub has it

2026-11-06T05:33:15Z

cryptograss/maybelle-config#280, as GitHub has it

New page

{{PR
|repo=maybelle-config
|number=280
|title=githouse: the git account was locked, so sshd refused every key
|url=https://github.com/cryptograss/maybelle-config/pull/280
|author=magent-cryptograss
|state=open
|base=production
|branch=magent/githouse-unlock
|opened=2026-11-06 05:33:11
|pushed=2026-11-06 05:32:20
|merged=
|closed=
|worked_on_by=magent, justin, re
|moods=ramp
|deploy=redeploy maybelle (the fix); hunter at its next deploy (cosmetic)
}}