VersionControl:PRs/maybelle-config/280

maybelle-config#280: githouse: the git account was locked, so sshd refused every key

State	🟣 merged 2026-11-06 05:36:03
Worked on by	magent, justin, re
Moods	#ramp
Deploy	redeploy maybelle (the fix); hunter at its next deploy (cosmetic)
Branch	magent/githouse-unlock → production, by magent-cryptograss
Opened · last pushed	2026-11-06 05:33:11 · 2026-11-06 05:32:20

githouse's first deploy (#250, maybelle 6 Nov 05:08Z, hunter 05:22Z) had everything in place except the door: the relayed keys arrived on maybelle, `authorized_keys` had four lines by 05:23Z, and every push and the mirror's fetch still got `Permission denied (publickey)`.

**Cause:** `useradd` leaves the `git` account's password field as `!`, which sshd reads as a locked account and refuses even by key. sshd logged to syslog inside the container, so `docker logs githouse` showed nothing, and the deploy's wait for `branches.json` passed because `init` writes that file too.

**Reproduced and fixed in a throwaway container on hunter** (`githouse-test` and `githouse-locked`, both removed after): the deployed image's state, with the account locked, gave `User git not allowed because account is locked`; the fixed image accepted the same key, ran the forced command (`githouse: only git fetch and git push here`), and `git ls-remote` through it reached `auth` (`no repository nothing here`).

**Changes:**
- `Dockerfile`: `usermod -p '*' git`. An unusable password, not a locked one. The standard git-server fix.
- `entrypoint.sh`: `sshd -D -e &`, so its log goes to stderr and `docker logs githouse` says why a key was refused.
- `githouse.py`: the keys are rebuilt each round before the fetches, repositories or none (before, no repositories meant no `authorized_keys` ever).
- `container_startup.py`: magent's key is published from `emergent-magent` only. The `magent` unix user exists in every container, so each had been publishing a `magent.pub` beside its own emergent's key; maybelle ignored them, but the relay should carry one key per name.

Tests: `test_githouse.py` 17, `test_container_startup.py` 36 (one extended: the key is made but not published where `publish=False`). Both pass. render-diff is clean against production.

Deploy: redeploy maybelle (the fix); hunter at its next deploy (cosmetic)
Worked on by: magent, Justin, re, in #ramp