git.iko.soy/vibebox
on main help sign in
fix: now fixed ssh unstable
2c08e29robcholz
src/ssh.sh+102−29
compare with main
unifiedsplit
@@ -5,13 +5,56 @@ SSH_USER="__SSH_USER__"
5PROJECT_NAME="__PROJECT_NAME__"
5PROJECT_NAME="__PROJECT_NAME__"
6KEY_PATH="__KEY_PATH__"
6KEY_PATH="__KEY_PATH__"
7
7
8+diag() { echo "[vibebox][diag] $*" >&2; }
9+
10+# Extract default route facts (no hardcode)
11+default_route_line() { ip -4 route show default 2>/dev/null | head -n 1 || true; }
12+default_dev() {
13+ default_route_line | awk '{for(i=1;i<=NF;i++) if($i=="dev"){print $(i+1); exit}}'
14+}
15+default_gw() {
16+ default_route_line | awk '{for(i=1;i<=NF;i++) if($i=="via"){print $(i+1); exit}}'
17+}
18+
19+dump_diag() {
20+ diag "=== default route ==="
21+ default_route_line >&2 || true
22+
23+ diag "=== systemctl status ssh ==="
24+ systemctl status ssh --no-pager >&2 || true
25+
26+ diag "=== journalctl -u ssh (tail) ==="
27+ journalctl -u ssh -n 120 --no-pager >&2 || true
28+
29+ diag "=== sshd -t ==="
30+ sshd -t >&2 || true
31+
32+ diag "=== sshd -T (listen/addressfamily) ==="
33+ sshd -T 2>/dev/null | egrep -i '^(listenaddress|addressfamily|port|permitrootlogin|allowusers)\b' >&2 || true
34+
35+ diag "=== listeners on :22 ==="
36+ ss -lntp 2>/dev/null | awk 'NR==1 || $4 ~ /:22$/' >&2 || true
37+
38+ diag "=== ip -br addr ==="
39+ ip -br addr >&2 || true
40+
41+ diag "=== ip route ==="
42+ ip route >&2 || true
43+
44+ gw="$(default_gw || true)"
45+ if [ -n "$gw" ]; then
46+ diag "=== ping default gateway ($gw) ==="
47+ ping -c1 -W1 "$gw" >/dev/null 2>&1 && diag "ping gw OK" || diag "ping gw FAIL"
48+ fi
49+}
50+
8# 1) tmpfs mount
51# 1) tmpfs mount
9TARGET="/root/${PROJECT_NAME}/.vibebox"
52TARGET="/root/${PROJECT_NAME}/.vibebox"
10if [ -d "$TARGET" ] && ! mountpoint -q "$TARGET"; then
53if [ -d "$TARGET" ] && ! mountpoint -q "$TARGET"; then
11 mount -t tmpfs tmpfs "$TARGET"
54 mount -t tmpfs tmpfs "$TARGET"
12fi
55fi
13
56
14−# 2)
57+# 2) user + authorized_keys
15if ! id -u "$SSH_USER" >/dev/null 2>&1; then
58if ! id -u "$SSH_USER" >/dev/null 2>&1; then
16 useradd -m -s /bin/bash -U "$SSH_USER"
59 useradd -m -s /bin/bash -U "$SSH_USER"
17 usermod -aG sudo "$SSH_USER" || true
60 usermod -aG sudo "$SSH_USER" || true
@@ -20,41 +63,71 @@ fi
20install -d -m 700 -o "$SSH_USER" -g "$SSH_USER" "/home/${SSH_USER}/.ssh"
63install -d -m 700 -o "$SSH_USER" -g "$SSH_USER" "/home/${SSH_USER}/.ssh"
21install -m 600 -o "$SSH_USER" -g "$SSH_USER" "$KEY_PATH" "/home/${SSH_USER}/.ssh/authorized_keys"
64install -m 600 -o "$SSH_USER" -g "$SSH_USER" "$KEY_PATH" "/home/${SSH_USER}/.ssh/authorized_keys"
22
65
23−# 3)
66+# 3) start ssh (don't swallow failures)
67+# If ssh is already active, don't force start/restart.
68+if ! systemctl is-active --quiet ssh; then
69+ if ! systemctl start ssh; then
24−systemctl start ssh >/dev/null 2>&1 || true
70+ diag "systemctl start ssh failed"
25−
71+ dump_diag
26−# 4)
72+ exit 1
27−i=0
28−while :; do
29− if ss -lnt 2>/dev/null | awk '{print $4}' | grep -qE '(:22)$'; then
30− break
31 fi
73 fi
32− i=$((i+1))
74+fi
33− [ "$i" -ge 40 ] && break # ~4s
34− sleep 0.1
35−done
36
75
37−echo VIBEBOX_SSH_READY
76+# 4) obtain stable IPv4 on the default-route interface (wait up to ~30s)
77+ip_on_dev() {
78+ dev="$1"
79+ ip -4 -o addr show dev "$dev" scope global 2>/dev/null \
80+ | awk '{print $4}' | cut -d/ -f1 | head -n 1 || true
81+}
38
82
39−find_ip() {
83+ip=""
40− if command -v ip >/dev/null 2>&1; then
84+dev=""
41− ip -4 -o addr show scope global 2>/dev/null | awk '{print $4}' | cut -d/ -f1 | head -n 1
85+gw=""
42− return
86+t=0
87+while [ "$t" -lt 60 ]; do
88+ dev="$(default_dev || true)"
89+ gw="$(default_gw || true)"
90+ if [ -n "$dev" ]; then
91+ ip="$(ip_on_dev "$dev")"
92+ else
93+ ip=""
43 fi
94 fi
95+
96+ if [ -n "$dev" ] && [ -n "$ip" ]; then
97+ # optional: if a gateway exists, require it to answer to avoid "ip exists but link dead"
44− if command -v hostname >/dev/null 2>&1; then
98+ if [ -z "$gw" ] || ping -c1 -W1 "$gw" >/dev/null 2>&1; then
45− hostname -I 2>/dev/null | awk '{print $1}'
99+ break
46− return
100+ fi
47 fi
101 fi
102+
103+ t=$((t+1))
104+ sleep 0.5
105+done
106+
107+if [ -z "$dev" ] || [ -z "$ip" ]; then
108+ diag "no stable IPv4 on default route interface"
109+ dump_diag
110+ exit 1
111+fi
112+
113+# 5) strong verify: ssh must listen externally (0.0.0.0:22 or $ip:22 or [::]:22)
114+listens_ok() {
115+ ss -lnt 2>/dev/null \
116+ | awk 'NR>1 {print $4}' \
117+ | grep -Eq "^(0\.0\.0\.0:22|\\[::\\]:22|${ip}:22)$"
48}
118}
49
119
50i=0
120i=0
51−while :; do
121+while ! listens_ok && [ "$i" -lt 80 ]; do # ~8s
52− ip="$(find_ip || true)"
53− if [ -n "$ip" ]; then
54− echo VIBEBOX_IPV4=$ip
55− break
56− fi
57 i=$((i+1))
122 i=$((i+1))
58− [ "$i" -ge 60 ] && break
59− sleep 0.5
123+ sleep 0.1
60done
124done
125+
126+if ! listens_ok; then
127+ diag "sshd not listening on 0.0.0.0:22 / ${ip}:22"
128+ dump_diag
129+ exit 1
130+fi
131+
132+echo VIBEBOX_SSH_READY
133+echo "VIBEBOX_IPV4=$ip"