aaron/infra-core
1
0
Fork 2
Code Issues Pull requests 12 Projects Releases 1 Packages Wiki Activity Actions

fix(paperclip): mount dev-agent SSH key at $HOME (/paperclip/.ssh) (HOMELAB-1104) #226

Merged
aaron merged 1 commit from plane/HOMELAB-1104-paperclip-ssh-key-path into live 2026-06-12 02:08:02 +00:00
Conversation 0 Commits 1 Files changed 1 +1 -1
aaron commented 2026-06-12 02:07:53 +00:00
Owner
Copy link

What

The Paperclip pod runs with HOME=/paperclip, but the chart mounted the dev-agent SSH key at /home/node/.ssh/id_ed25519. When the pi_local SSH driver connects without an explicit privateKey, ssh searches $HOME/.ssh/id_ed25519 (= /paperclip/.ssh/id_ed25519) which didn't exist. The end-to-end chain works only when -i is passed explicitly.

Fix

Change the dev-agent-ssh volumeMount mountPath from /home/node/.ssh/id_ed25519 → /paperclip/.ssh/id_ed25519. The volumes: secret block is unchanged.

Result

SSH Environment records can be created with no privateKey stored in the Paperclip DB — the key flows only via the K8s secret. This matches the GitOps approach.

Risk

Low — volumeMount path change only. Triggers a pod restart on sync (Recreate strategy, brief downtime). No DB migration.

Verify

From the pod after deploy:

ssh -o BatchMode=yes -o StrictHostKeyChecking=no \
  paperclip-operator@10.10.10.5 'pi --version'

Should succeed without -i flag.

## What The Paperclip pod runs with `HOME=/paperclip`, but the chart mounted the dev-agent SSH key at `/home/node/.ssh/id_ed25519`. When the `pi_local` SSH driver connects **without** an explicit `privateKey`, ssh searches `$HOME/.ssh/id_ed25519` (= `/paperclip/.ssh/id_ed25519`) which didn't exist. The end-to-end chain works only when `-i` is passed explicitly. ## Fix Change the `dev-agent-ssh` volumeMount `mountPath` from `/home/node/.ssh/id_ed25519` → `/paperclip/.ssh/id_ed25519`. The `volumes:` secret block is unchanged. ## Result SSH Environment records can be created with **no `privateKey`** stored in the Paperclip DB — the key flows only via the K8s secret. This matches the GitOps approach. ## Risk Low — volumeMount path change only. Triggers a pod restart on sync (Recreate strategy, brief downtime). No DB migration. ## Verify From the pod after deploy: ```bash ssh -o BatchMode=yes -o StrictHostKeyChecking=no \ paperclip-operator@10.10.10.5 'pi --version' ``` Should succeed **without** `-i` flag.
fix(paperclip): mount dev-agent SSH key at $HOME (/paperclip/.ssh) (HOMELAB-1104)
Some checks failed
0/0 projects applied successfully.
CI Review / pr-title (pull_request) Has been cancelled
Details
Lint & Validate / terraform-validate (pull_request) Has been cancelled
Details
Lint & Validate / yaml-lint (pull_request) Has been cancelled
Details
Lint & Validate / shellcheck (pull_request) Has been cancelled
Details
CI Review / helm-validate (pull_request) Has been cancelled
Details
CI Review / ai-review (pull_request) Has been cancelled
Details
c9bf6a3f3d 
The Paperclip pod runs with HOME=/paperclip, but the chart mounted the
dev-agent SSH key at /home/node/.ssh/id_ed25519. When the pi_local SSH
driver connects without an explicit privateKey, ssh searches
$HOME/.ssh/id_ed25519 (= /paperclip/.ssh/id_ed25519) which didn't exist.

Fix: change volumeMount mountPath from /home/node/.ssh/id_ed25519 to
/paperclip/.ssh/id_ed25519. The volumes: secret block is unchanged.
This enables SSH Environment records with NO privateKey stored in the
Paperclip DB — the key flows only via the K8s secret.

Co-Authored-By: Claude <claude@anthropic.com>
aaron merged commit f289d9beb5 into live 2026-06-12 02:08:02 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
aaron/infra-core!226
No description provided.