sergio/hammer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

granja: fix host-key en workers efímeros — known_hosts a /dev/null

Browse Source 
Los workers efímeros reciclan IPs de Hetzner. accept-new RECHAZA una clave de host
cambiada ⇒ el 'until ssh true' de farm-up colgaba para siempre en una IP reusada.
Como el modelo es hub-and-spoke (worker sin secretos, compute descartable) no hay
superficie MITM: saltamos verificación de host y no ensuciamos known_hosts.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
sergio
2026-07-06 06:56:25 -04:00
co-authored by Claude Opus 4.8
parent b90855dc30
commit e2e5bc6f04
3 changed files with 11 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/farm/farm-down.sh
+3 -1
View File
@@ -16,7 +16,9 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
REMOTE="${REMOTE:-/opt/hammer}"
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
FLEET="$ROOT/scripts/farm/.fleet"
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
# Ver nota en farm-up.sh: workers efímeros reciclan IPs ⇒ known_hosts a /dev/null (hub-and-spoke,
# worker sin secretos, sin superficie MITM que proteger).
SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
cd "$ROOT"
[ -s "$FLEET" ] || { echo "flota vacía (scripts/farm/.fleet)"; exit 0; }
scripts/farm/farm-run.sh
+3 -1
View File
@@ -26,7 +26,9 @@ MAXWAIT="${MAXWAIT:-21600}"
SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
FLEET="$ROOT/scripts/farm/.fleet"
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
# Ver nota en farm-up.sh: workers efímeros reciclan IPs ⇒ known_hosts a /dev/null (hub-and-spoke,
# worker sin secretos, sin superficie MITM que proteger).
SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
cd "$ROOT"
cycles() { $SSH "root@$1" 'journalctl -u hammer-farm -o cat --no-pager 2>/dev/null | grep -c "ciclo terminado"' 2>/dev/null || echo 0; }
scripts/farm/farm-up.sh
+5 -1
View File
@@ -26,7 +26,11 @@ SSH_KEY="${SSH_KEY:-$HOME/.ssh/github5}"
REMOTE="${REMOTE:-/opt/hammer}"
ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
FLEET="$ROOT/scripts/farm/.fleet"
SSH="ssh -i $SSH_KEY -o StrictHostKeyChecking=accept-new -o ConnectTimeout=10"
# Workers efímeros RECICLAN IPs de Hetzner ⇒ un known_hosts persistente choca ("HOST KEY CHANGED")
# y accept-new RECHAZA la clave cambiada, colgando el `until ssh true` para siempre. Como el modelo
# es hub-and-spoke (el worker NO tiene secretos: compute puro descartable), saltamos la verificación
# de host y no ensuciamos known_hosts (/dev/null). No hay superficie MITM que proteger acá.
SSH="ssh -i $SSH_KEY -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o LogLevel=ERROR -o ConnectTimeout=10"
cd "$ROOT"
touch "$FLEET"