From bfde490ad4984023b15b23c63b5927c0e49f3157 Mon Sep 17 00:00:00 2001 From: rcourtman Date: Sun, 19 Oct 2025 08:56:52 +0000 Subject: [PATCH] fix: add unrestricted SSH key for ProxyJump on jump host When using ProxyJump for cluster temperature monitoring, the jump host (typically the first cluster node) needs an unrestricted SSH key to allow connection forwarding. Previously only the restricted key with command="sensors -j" was added, which blocked ProxyJump. Now the setup script adds TWO keys: 1. Unrestricted key (for ProxyJump/connection forwarding) 2. Restricted key (for running sensors -j directly) This allows containerized Pulse to: - Connect through the jump host to other cluster nodes - Collect temperature data from all cluster members Fixes cluster temperature monitoring for Docker/LXC deployments. --- internal/api/config_handlers.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/internal/api/config_handlers.go b/internal/api/config_handlers.go index 7c56c48..227b433 100644 --- a/internal/api/config_handlers.go +++ b/internal/api/config_handlers.go @@ -3865,6 +3865,16 @@ elif [ "$TEMP_MONITORING_AVAILABLE" = true ]; then echo " ✓ SSH key configured (restricted to sensors -j)" fi + # Add unrestricted key for ProxyJump (needed for containerized Pulse) + # This allows the node to act as SSH jump host to other cluster members + SSH_PROXYJUMP_ENTRY="$SSH_PUBLIC_KEY # pulse-proxyjump" + if [ -f /root/.ssh/authorized_keys ] && grep -qF "# pulse-proxyjump" /root/.ssh/authorized_keys 2>/dev/null; then + : # ProxyJump key already exists + else + echo "$SSH_PROXYJUMP_ENTRY" >> /root/.ssh/authorized_keys + chmod 600 /root/.ssh/authorized_keys + fi + # Check if this is a Raspberry Pi IS_RPI=false if [ -f /proc/device-tree/model ] && grep -qi "raspberry pi" /proc/device-tree/model 2>/dev/null; then