feat(justfile): interactive SSH shorthands per Linux unit #20

Merged

Philipp Baumann merged 1 commit from fm/dse-security-reports-ssh-shortcuts into main

2026-10-28 06:49:42 +00:00

Philipp Baumann commented

2026-10-28 06:42:30 +00:00

Owner

Summary

Reaching the Linux units meant typing a long ssh command with a config path, login name and options, or looking the endpoint up by hand.
This adds one just ssh-<short> recipe per Linux unit that opens an interactive shell as the admin account, with every connection detail resolved at run time.
The endpoint resolution was factored out of scripts/ssh_evidence.sh into the sourced, shared scripts/ssh_common.sh -- factoring was chosen over mirroring so the evidence collector and the shorthands resolve through exactly one implementation and can never disagree about where a machine is.

What changed

scripts/ssh_common.sh (new): the shared resolution -- committed mapping sshAlias, candidate ansible ssh.cfg files in order, raw-address detection -- plus the shared option assembly (batch vs interactive): same account, same ConnectTimeout, -F <ssh.cfg> for aliases, StrictHostKeyChecking=accept-new for address-based connections.
scripts/ssh_connect.sh (new): resolves a unit through the shared library and execs ssh interactively (deliberately no BatchMode, unlike the evidence collector which must fail rather than prompt); --print <machine> prints the command that would run without connecting, --list resolves every unit with an SSH path and prints shorthand plus endpoint; an unresolvable unit fails with a message naming the unit, never a silent no-op or a connection attempt against an empty host.
scripts/ssh_evidence.sh: sources the shared library instead of its inline resolution; the assembled batch options, account, timeout and skip behavior are unchanged.
Justfile: eight ssh-<short> recipes (short = lowercased machine name without the ASP- prefix, e.g. just ssh-dse-prod-wireguard; the WireGuard evidence-only unit is included) plus ssh-list; the recipes carry only unit names -- no IP, hostname, key or config path lives in the Justfile, verified by reading the final file.
README.md: two brief bullets in the pipeline map pointing at the recipes (the task explicitly asked for the docs entry in the pipeline documentation; the README is otherwise handwritten, so these two lines deserve close review).
AGENTS.md: one sentence pointing at the shorthands and the shared resolution.

Behaviour change

The evidence collector behaves exactly as before (same options, same skips, same cache handling); new interactive recipes open shells on the eight Linux units, and just ssh-list / ./scripts/ssh_connect.sh --print <machine> make the resolution inspectable offline.
The three Windows units are out of scope by design (no Linux, no SSH path) and get no shorthand.

Verification without a live connection: just all and just repro pass on the synthetic fixture (byte-identical PDFs); just ssh-list resolves all eight units offline (analytics and myride through their own ssh.cfg, QMS and VS by raw address with accept-new); --print shows the exact command per unit; a unit without a resolvable endpoint (e.g. ASP-DSE-PROD-MISC) and a unit whose alias no ssh.cfg defines both fail with messages naming the unit.
No render was required for this change: reports/ is untouched (concurrently owned by another task), no PDF was re-rendered and nothing was published into the artifacts dir.

Instructions-PR: none

## Summary Reaching the Linux units meant typing a long ssh command with a config path, login name and options, or looking the endpoint up by hand. This adds one `just ssh-<short>` recipe per Linux unit that opens an interactive shell as the admin account, with every connection detail resolved at run time. The endpoint resolution was factored out of `scripts/ssh_evidence.sh` into the sourced, shared `scripts/ssh_common.sh` -- factoring was chosen over mirroring so the evidence collector and the shorthands resolve through exactly one implementation and can never disagree about where a machine is. ## What changed - `scripts/ssh_common.sh` (new): the shared resolution -- committed mapping `sshAlias`, candidate ansible ssh.cfg files in order, raw-address detection -- plus the shared option assembly (`batch` vs `interactive`): same account, same `ConnectTimeout`, `-F <ssh.cfg>` for aliases, `StrictHostKeyChecking=accept-new` for address-based connections. - `scripts/ssh_connect.sh` (new): resolves a unit through the shared library and execs ssh interactively (deliberately no `BatchMode`, unlike the evidence collector which must fail rather than prompt); `--print <machine>` prints the command that would run without connecting, `--list` resolves every unit with an SSH path and prints shorthand plus endpoint; an unresolvable unit fails with a message naming the unit, never a silent no-op or a connection attempt against an empty host. - `scripts/ssh_evidence.sh`: sources the shared library instead of its inline resolution; the assembled batch options, account, timeout and skip behavior are unchanged. - `Justfile`: eight `ssh-<short>` recipes (short = lowercased machine name without the `ASP-` prefix, e.g. `just ssh-dse-prod-wireguard`; the WireGuard evidence-only unit is included) plus `ssh-list`; the recipes carry only unit names -- no IP, hostname, key or config path lives in the Justfile, verified by reading the final file. - `README.md`: two brief bullets in the pipeline map pointing at the recipes (the task explicitly asked for the docs entry in the pipeline documentation; the README is otherwise handwritten, so these two lines deserve close review). - `AGENTS.md`: one sentence pointing at the shorthands and the shared resolution. ## Behaviour change The evidence collector behaves exactly as before (same options, same skips, same cache handling); new interactive recipes open shells on the eight Linux units, and `just ssh-list` / `./scripts/ssh_connect.sh --print <machine>` make the resolution inspectable offline. The three Windows units are out of scope by design (no Linux, no SSH path) and get no shorthand. Verification without a live connection: `just all` and `just repro` pass on the synthetic fixture (byte-identical PDFs); `just ssh-list` resolves all eight units offline (analytics and myride through their own ssh.cfg, QMS and VS by raw address with `accept-new`); `--print` shows the exact command per unit; a unit without a resolvable endpoint (e.g. `ASP-DSE-PROD-MISC`) and a unit whose alias no ssh.cfg defines both fail with messages naming the unit. No render was required for this change: `reports/` is untouched (concurrently owned by another task), no PDF was re-rendered and nothing was published into the artifacts dir. Instructions-PR: none

Philipp Baumann added 1 commit

2026-10-28 06:42:30 +00:00

feat(justfile): interactive SSH shorthands per Linux unit 9a2f0b2aeb

- Add a `just ssh-<short>` recipe per Linux unit (short = lowercased
  machine name without the ASP- prefix) that opens an interactive shell
  as the admin account, plus `just ssh-list` to show every shorthand
  with its resolved endpoint without connecting.
- Factor the endpoint resolution (committed mapping sshAlias, candidate
  ansible ssh.cfg files, raw-address detection, shared connection
  options) out of scripts/ssh_evidence.sh into the sourced
  scripts/ssh_common.sh, so the evidence collector and the new
  scripts/ssh_connect.sh resolve every unit through exactly one
  implementation and can never disagree about where a machine is.
- Keep the same account and ConnectTimeout in both callers, with
  StrictHostKeyChecking=accept-new for address-based connections; the
  shorthand is deliberately interactive (no BatchMode), unlike the
  evidence collector, which must fail rather than prompt.
- Carry only unit names in the Justfile: endpoints, accounts and
  config paths resolve at run time; an unresolvable unit fails with a
  message naming the unit, never a connection attempt against an empty
  host.
- Record the shorthands briefly in the README pipeline map and the
  project agent notes, pointing at the recipes.

Philipp Baumann merged commit f2f64ff488 into main

2026-10-28 06:49:42 +00:00

Philipp Baumann deleted branch fm/dse-security-reports-ssh-shortcuts

2026-10-28 06:49:42 +00:00

Philipp Baumann referenced this pull request from a commit

2026-10-28 06:49:44 +00:00

feat(justfile): interactive SSH shorthands per Linux unit (#20)