Use a dedicated proxmox_ssh_automation_key, not proxmox_ssh_root_key #5

Merged

sysadmin merged 1 commit from fix/proxmox-automation-ssh-key into main

2026-10-06 15:14:32 +00:00

sysadmin commented

2026-10-06 15:00:12 +00:00

Contributor

Corrects PR #4: that fix reused proxmox_ssh_root_key for delegate_to SSH, but that variable is the PUBLIC key pushed into new containers' own authorized_keys, not a usable credential for connecting to the Proxmox hosts. A manual verification had appeared to confirm it worked, but that check was a false positive from the tester's own SSH agent silently completing the handshake -- caught by re-testing with IdentitiesOnly=yes.

Generated a dedicated keypair, added the public half to root's authorized_keys on both srv-proxmox01 and srv-proxmox02, verified it authenticates with agent fallback disabled, wired the private half in as proxmox_ssh_automation_key (companion commit in infrastructure/homelab).

🤖 Generated with Claude Code

https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

Corrects PR #4: that fix reused `proxmox_ssh_root_key` for delegate_to SSH, but that variable is the PUBLIC key pushed into new containers' own authorized_keys, not a usable credential for connecting to the Proxmox hosts. A manual verification had appeared to confirm it worked, but that check was a false positive from the tester's own SSH agent silently completing the handshake -- caught by re-testing with `IdentitiesOnly=yes`. Generated a dedicated keypair, added the public half to root's authorized_keys on both srv-proxmox01 and srv-proxmox02, verified it authenticates with agent fallback disabled, wired the private half in as `proxmox_ssh_automation_key` (companion commit in infrastructure/homelab). 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin added 1 commit

2026-10-06 15:00:13 +00:00

Use a dedicated proxmox_ssh_automation_key, not proxmox_ssh_root_key

Ansible Lint / ansible-lint (pull_request) Successful in 1m47s

Details

acac54cbae

The previous fix (merged as PR #4) reused proxmox_ssh_root_key for
delegate_to: proxmox_api_host SSH connections. That variable is actually
the PUBLIC key pushed into newly-created containers' own authorized_keys
(see metadata.yml's own 2026-09-12 comment) -- not a usable credential
for connecting to the Proxmox hosts themselves. It looked plausible
(resolved via the same OpenBao path, same no_log discipline) and an
initial manual verification appeared to confirm it, but that check was a
false positive: it ran with SSH agent fallback still enabled, which
silently completed the handshake via the tester's own loaded identity
instead of the file actually passed to -i.

Caught live by re-running the same check with IdentitiesOnly=yes (no
agent, no other identities) -- the public key alone fails outright,
matching the real Semaphore failure exactly. Generated a dedicated
keypair, added its public half to root's authorized_keys on both
srv-proxmox01 and srv-proxmox02, verified it authenticates with agent
fallback disabled on both, and wired the private half in as
proxmox_ssh_automation_key (homelab infra repo, separate commit).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012icUrjv3vgHtovVpHUFjdp

sysadmin merged commit 8ff690df52 into main

2026-10-06 15:14:32 +00:00

sysadmin referenced this pull request from a commit

2026-10-06 15:14:34 +00:00

Merge pull request 'Use a dedicated proxmox_ssh_automation_key, not proxmox_ssh_root_key' (#5) from fix/proxmox-automation-ssh-key into main