odysseus-core 0.10.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6d1b931d263332fd0a431b4a0842949f52d78f2f366f8dbf72cb98f0ea95282
-  data.tar.gz: f3ea3a6477a88cbd38b1386f04e983bad5d7d782475f46322989568389e4fa5b
+  metadata.gz: cfc5413226161f5c572dfac62bc9f3a1c13374135525e023d7462b9531bea3b7
+  data.tar.gz: 6dcd045639190f23f0131a1b5042c5c3fc378521dcbe7151305a2983fbbb38f5
 SHA512:
-  metadata.gz: b89f611e20800ecfbdbd30fe571b6a9979877a59f52655a0c05fb3aeadc7567f6af4325711c92eb02698bbdd23c1746f6c1d150436e20dc45318a4f0fae0f1b4
-  data.tar.gz: 6db503709fb510a38980f0357a69f82f07b7b04e77b8b63c7286035f88425134039c06618164648876324a4a22f902341d4ca41fa4bb5a027a5addc07a4a7309
+  metadata.gz: a9fc554c9aa8188282f3a5d3cf1869b8df86c8145c1895ba4f837d38e896d6f90509922e31eb83150fd451f09862a1a39ef43927f48d6e1cc2ecb3cd14cd795c
+  data.tar.gz: 5968a74f44b8184f1c1cd53661073312cf7ca081a4c9f8eef68637624465a99ffc1f3bea626a8fedaba17a0b72a6231ed91142e11345ab034594c5bf2c76bf5e

data/CHANGELOG.md

@@ -7,6 +7,59 @@ gem artifacts, so they are summaries rather than contemporaneous notes.
 
 ## [Unreleased]
 
+## [0.10.1] - 2026-09-16
+
+### Fixed
+
+- odysseus could not read an SSH key from disk unless ssh-agent happened to be
+  holding it. `net-ssh` needs `ed25519` and `bcrypt_pbkdf` to parse anything in
+  the `-----BEGIN OPENSSH PRIVATE KEY-----` container -- which is what every
+  modern `ssh-keygen` writes, **RSA included, not only ed25519** -- and neither
+  was declared, so `key_factory.rb` raised `NotImplementedError` before it ever
+  looked at the algorithm. Both are runtime dependencies now. Reported by a
+  tester whose deploys failed with a passphrase-protected key; the passphrase
+  was not the cause, the key format was.
+
+- A passphrase-protected SSH key is no longer reported as "Check your SSH
+  keys." odysseus connects with `non_interactive: true` -- a passphrase prompt
+  on a deploy connection can never be answered, so prompting would hang rather
+  than help -- and net-ssh reports the resulting key-loading failure to a
+  logger rather than raising it, so with none configured the reason was
+  discarded and the reader was sent to inspect keys that were entirely correct.
+  The failure now names each locked key and gives the `ssh-add` line for it.
+  `Odysseus::SSHKey.encrypted?` answers that by reading the cipher named in the
+  key file, so no passphrase is needed to detect one.
+
+- `docker pussh` no longer hangs silently. It ran through backticks with
+  everything folded into a captured string, which had three consequences: no
+  output reached the terminal until the push finished, so a healthy push and a
+  stuck one looked identical; there was no timeout; and stdin stayed attached
+  to the parent, so a child that asked a question waited forever on an answer
+  nobody could see it requesting. Output now streams as it arrives, stdin is
+  closed so any prompt reaches EOF and fails promptly, and a push is bounded by
+  `PUSSH_TIMEOUT` (30 minutes -- generous, since it exists to end a hang rather
+  than to police a slow link). A push that does time out now suggests what to
+  check, including the Tailscale steps `SSH#with_connection` already gives for
+  the deploy connection but which `pussh` never reached.
+
+### Changed
+
+- Every container odysseus starts now has a bounded log. Containers inherited
+  the daemon's default logging, which on a stock Docker install is `json-file`
+  with no size limit, so a long-lived container filled the disk -- most visibly
+  `odysseus-caddy`, the one container no deploy ever replaces. Every
+  `docker run` now carries `--log-driver json-file --log-opt max-size=100m
+  --log-opt max-file=3`.
+
+  The driver is named rather than left to the daemon because `max-size` and
+  `max-file` belong to `json-file` and `local` only: on a host defaulting to
+  `journald` or `syslog`, docker refuses the run rather than ignoring them.
+  Naming it also makes explicit what `odysseus logs` already assumed, since it
+  shells out to `docker logs`.
+
+  **This overrides a deliberate daemon-wide log driver on the host.** Making the
+  driver and options configurable per service is tracked in TODO.md.
+
 ## [0.10.0] - 2026-08-28
 
 ### Fixed
@@ -471,6 +524,25 @@ previously reported success while failing will now stop and say so.
 - `rake` runs RSpec and RuboCop clean. Remaining Metrics offences are recorded
   in `.rubocop_todo.yml` rather than hidden in the main configuration.
 
+## [0.3.2] - 2026-08-12
+
+Reconstructed after the fact: 0.3.2 was bumped in `version.rb` but never
+tagged, and the change first reached users in 0.4.0.
+
+### Fixed
+
+- Adding a hostname to `proxy.hosts` had no effect on an already-deployed
+  service. `Caddy::Client#add_upstream` reconciled only the upstreams of an
+  existing route, never its Host matcher, so the route kept whatever hosts it
+  was created with until it was deleted by hand. TLS was unaffected --
+  `enable_tls_for_hosts` always received the full list -- which made the
+  failure confusing: Caddy answered the new hostname over HTTPS with a valid
+  certificate, matched no route, and served the default handler instead of the
+  service. `add_upstream` now PATCHes `match/0/host` when the configured hosts
+  differ from the deployed ones. The repair needs one deploy: the reconcile
+  runs during `add_upstream`, so upgrading alone leaves an existing route as it
+  was.
+
 ## [0.3.1] - 2026-04-05
 
 ### Fixed

data/lib/odysseus/builder/client.rb

@@ -1,8 +1,14 @@
 # lib/odysseus/builder/client.rb
 
+require 'open3'
+
 module Odysseus
   module Builder
     class Client
+      # A push moves a whole image over SSH, so this is generous -- it exists
+      # to end a hang, not to police a slow link.
+      PUSSH_TIMEOUT = 1800 # seconds
+
       # @param config [Hash] builder config from deploy.yml
       # @param ssh_config [Hash] SSH config (user, keys)
       # @param logger [Object] logger
@@ -85,11 +91,28 @@ module Odysseus
         cmd = "docker pussh #{image} #{target}"
         @logger.debug(cmd) if @logger.respond_to?(:debug)
 
-        output = execute_local_command(cmd)
+        output = execute_local_command(cmd, timeout: PUSSH_TIMEOUT)
         { success: true, output: output, host: host }
       rescue BuildError => e
-        @logger.error("Pussh failed: #{e.message}")
-        { success: false, error: e.message, host: host }
+        message = push_failure_message(e, host)
+        @logger.error("Pussh failed: #{message}")
+        { success: false, error: message, host: host }
+      end
+
+      # A push that timed out almost never failed because of docker. It failed
+      # because the host could not be reached, and the commonest reason here is
+      # Tailscale -- which SSH#with_connection already explains for the deploy
+      # connection, but `docker pussh` shells out to the system ssh and reaches
+      # none of that handling.
+      def push_failure_message(error, host)
+        return error.message unless error.message.include?('timed out')
+
+        "#{error.message}\n\n" \
+          "The push could not reach #{host}. Worth checking:\n  " \
+          "1. Tailscale is running: tailscale status\n  " \
+          "2. You're authenticated: tailscale login\n  " \
+          "3. The host is online: tailscale ping #{host}\n  " \
+          "4. SSH works on its own: ssh #{host} true"
       end
 
       # Push image to multiple hosts via SSH
@@ -263,13 +286,69 @@ module Odysseus
         end
       end
 
-      def execute_local_command(cmd)
-        output = `#{cmd} 2>&1`
-        raise BuildError, "Command failed: #{output}" unless $?.success?
+      # Runs a local command, streaming its output and refusing to wait forever.
+      #
+      # This was `` `#{cmd} 2>&1` ``, and all three of its properties were
+      # wrong for `docker pussh`. Backticks capture everything into a string,
+      # so a push printed nothing until it returned and a healthy one looked
+      # exactly like a stuck one. There was no timeout. And stdin stayed
+      # attached to the parent, so a child that asked a question waited on an
+      # answer that could never be typed into output nobody could see -- the
+      # reported symptom was a push that hung with no message at all.
+      #
+      # stdin is /dev/null so that any prompt reaches EOF and the command fails
+      # promptly instead of hanging. Prompting is not something odysseus can
+      # usefully do here anyway: SSH#connect is non-interactive for the same
+      # reason.
+      #
+      # @param timeout [Integer, nil] seconds before the command is killed
+      # @raise [Odysseus::BuildError] on failure, or on timeout
+      def execute_local_command(cmd, timeout: nil)
+        output = +''
+
+        # pgroup: true is not optional. Without it the child shares this
+        # process's group, and terminate's kill(-pgid) would signal odysseus
+        # itself -- which it duly did the first time this was run.
+        Open3.popen2e(cmd, pgroup: true) do |stdin, out, wait_thread|
+          # Closed immediately, not redirected: popen2e makes its own stdin
+          # pipe and ignores an `in:` option. Closing it is what gives a child
+          # that asks a question an EOF instead of an indefinite wait.
+          stdin.close
+          reader = Thread.new do
+            out.each_line do |line|
+              output << line
+              @logger.info(line.chomp)
+            end
+          rescue IOError
+            nil # the stream is closed under us when a timeout kills the child
+          end
+
+          unless timeout.nil? || wait_thread.join(timeout)
+            terminate(wait_thread.pid)
+            reader.join(1)
+            raise BuildError, "Command timed out after #{timeout}s: #{cmd}\n#{output}"
+          end
+
+          wait_thread.join
+          reader.join
+          raise BuildError, "Command failed: #{output}" unless wait_thread.value.success?
+        end
 
         output
       end
 
+      # The child is usually a shell, so signal the whole process group -- else
+      # `sh -c 'docker pussh ...'` dies and leaves the push running.
+      def terminate(pid)
+        Process.kill('TERM', -Process.getpgid(pid))
+      rescue Errno::ESRCH, Errno::EPERM
+        begin
+          Process.kill('TERM', pid)
+        rescue Errno::ESRCH
+          nil
+        end
+      end
+
       def connect_to_build_host
         Odysseus::Deployer::SSH.new(
           host: @config[:host],

data/lib/odysseus/core/version.rb

@@ -2,6 +2,6 @@
 
 module Odysseus
   module Core
-    VERSION = '0.10.0'
+    VERSION = '0.10.1'
   end
 end

data/lib/odysseus/deployer/ssh.rb

@@ -167,8 +167,7 @@ module Odysseus
       rescue SocketError
         raise Odysseus::SSHConnectionError, "Could not resolve hostname '#{@host}'. Check your DNS or /etc/hosts."
       rescue Net::SSH::AuthenticationFailed
-        raise Odysseus::SSHAuthenticationError,
-              "SSH authentication failed for #{@user}@#{@host}. Check your SSH keys."
+        raise Odysseus::SSHAuthenticationError, authentication_failure_message
       rescue Errno::ETIMEDOUT, Net::SSH::ConnectionTimeout, Errno::EHOSTUNREACH
         error_msg = "Connection to #{@host} timed out."
         if @use_tailscale
@@ -190,6 +189,29 @@ module Odysseus
         raise Odysseus::SSHConnectionError, drop_message(open, e)
       end
 
+      # A passphrase-protected key reaches here as an ordinary authentication
+      # failure. net-ssh sends the real reason to a logger rather than raising
+      # it (key_manager.rb:319) and odysseus configures none, so without this
+      # the reader is told to check keys that are entirely correct.
+      #
+      # The advice is ssh-agent rather than a prompt on purpose: odysseus
+      # connects with non_interactive: true, and a passphrase prompt on a
+      # deploy connection cannot be answered -- it would hang the deploy
+      # instead of failing it.
+      def authentication_failure_message
+        base = "SSH authentication failed for #{@user}@#{@host}."
+        locked = @keys.select { |key| Odysseus::SSHKey.encrypted?(File.expand_path(key)) }
+
+        return "#{base} Check your SSH keys." if locked.empty?
+
+        "#{base}\n\n" \
+          "#{locked.length == 1 ? 'This key is' : 'These keys are'} passphrase-protected, and odysseus " \
+          "never prompts for one:\n" \
+          "#{locked.map { |key| "  #{key}" }.join("\n")}\n\n" \
+          "Add #{locked.length == 1 ? 'it' : 'them'} to your agent instead:\n" \
+          "#{locked.map { |key| "  ssh-add #{key}" }.join("\n")}"
+      end
+
       # @param open [Boolean, nil] whether the session was established
       def drop_message(open, error)
         return "Connection to #{@host} dropped mid-command rather than failing to open: #{error.message}" if open

data/lib/odysseus/docker/client.rb

@@ -9,6 +9,25 @@ module Odysseus
     class Client
       HEALTHCHECK_POLL_INTERVAL = 2 # seconds
 
+      # Applied to every container odysseus starts. Without them a container
+      # inherits the daemon's default logging, which on a stock Docker install
+      # is json-file with no size limit -- so a long-lived container fills the
+      # disk. Caddy is the clearest case, being the one container no deploy
+      # ever replaces, but a dependency that runs for months has the same
+      # problem, so this belongs on the shared path rather than on one caller.
+      #
+      # The driver is named rather than left to the daemon because max-size and
+      # max-file belong to json-file and local only: on a host defaulting to
+      # journald or syslog, passing them does not degrade gracefully, docker
+      # refuses the run. Naming it also makes explicit what the codebase
+      # already assumes -- `odysseus logs` shells out to `docker logs`, which
+      # most other drivers cannot answer.
+      #
+      # The cost, knowingly: a host with a deliberate daemon-wide log driver is
+      # overridden. Making these configurable is a separate TODO entry.
+      LOG_DRIVER = 'json-file'.freeze
+      LOG_OPTIONS = { 'max-size' => '100m', 'max-file' => '3' }.freeze
+
       # @param ssh [Odysseus::Deployer::SSH] SSH connection to server
       def initialize(ssh)
         @ssh = ssh
@@ -468,6 +487,14 @@ module Odysseus
         nil
       end
 
+      # Extracted from build_run_command rather than inlined there: the flags
+      # are fixed, and the method was already at RuboCop's complexity ceiling.
+      # @return [Array<String>] the --log-driver and --log-opt arguments
+      def log_args
+        ["--log-driver #{LOG_DRIVER}"] +
+          LOG_OPTIONS.map { |key, value| "--log-opt #{key}=#{value}" }
+      end
+
       def build_run_command(name:, image:, options:, env_file: nil)
         parts = ['docker run -d']
 
@@ -525,6 +552,10 @@ module Odysseus
         # Restart policy
         parts << "--restart #{options[:restart] || 'unless-stopped'}"
 
+        # Log rotation (see LOG_DRIVER/LOG_OPTIONS). Before the image, or
+        # docker would hand them to the container's entrypoint instead.
+        parts.concat(log_args)
+
         # Image
         parts << image
 

data/lib/odysseus/ssh_key.rb

@@ -0,0 +1,68 @@
+# lib/odysseus/ssh_key.rb
+
+require 'base64'
+
+module Odysseus
+  # Reads what can be known about a private key file without decrypting it.
+  #
+  # This exists for one message. odysseus connects with `non_interactive: true`
+  # -- a passphrase prompt on a deploy connection can never be answered, so
+  # prompting would hang rather than help. net-ssh reports the resulting
+  # key-loading failure to a logger rather than raising it
+  # (`key_manager.rb:319`), so with no logger configured the reason is
+  # discarded and authentication simply fails. The user is then told to check
+  # keys that are perfectly correct. Knowing which key is locked is what turns
+  # that into an answerable question.
+  module SSHKey
+    OPENSSH_HEADER = '-----BEGIN OPENSSH PRIVATE KEY-----'.freeze
+    OPENSSH_MAGIC = "openssh-key-v1\0".freeze
+    PEM_ENCRYPTED = /^Proc-Type:\s*4,ENCRYPTED/
+    NO_CIPHER = 'none'.freeze
+
+    class << self
+      # @param path [String] path to a private key file
+      # @return [Boolean] true only when the file is a private key that is
+      #   passphrase-protected. False for anything unreadable, absent, public,
+      #   or not a key: those are different failures with different messages,
+      #   and claiming a passphrase problem for them would send the reader
+      #   somewhere just as wrong as "check your SSH keys".
+      def encrypted?(path)
+        data = read(path)
+        return false unless data
+
+        data.include?(OPENSSH_HEADER) ? openssh_encrypted?(data) : PEM_ENCRYPTED.match?(data)
+      end
+
+      private
+
+      def read(path)
+        return nil unless File.file?(path)
+
+        File.read(path)
+      rescue SystemCallError, IOError
+        nil
+      end
+
+      # An OpenSSH-format key states its cipher in the binary body rather than
+      # in a header: the magic "openssh-key-v1\0", then a 4-byte big-endian
+      # length and that many bytes of cipher name, which is "none" when the key
+      # is not encrypted. Read rather than decrypted, so no passphrase is
+      # needed to answer the question.
+      def openssh_encrypted?(data)
+        body = data[/#{Regexp.escape(OPENSSH_HEADER)}\n(.*?)\n-----END/m, 1]
+        return false unless body
+
+        raw = Base64.decode64(body)
+        return false unless raw.start_with?(OPENSSH_MAGIC)
+
+        rest = raw.byteslice(OPENSSH_MAGIC.bytesize..) || ''
+        return false if rest.bytesize < 4
+
+        length = rest.byteslice(0, 4).unpack1('N')
+        cipher = rest.byteslice(4, length)
+
+        !cipher.nil? && cipher != NO_CIPHER
+      end
+    end
+  end
+end

data/lib/odysseus.rb

@@ -9,6 +9,7 @@ module Odysseus
         loader = Zeitwerk::Loader.for_gem(warn_on_extra_files: false)
         loader.inflector.inflect(
           'ssh' => 'SSH',
+          'ssh_key' => 'SSHKey',
           'aws_asg' => 'AwsAsg'
         )
         # errors.rb doesn't follow Zeitwerk conventions (plural, defines multiple classes)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: odysseus-core
 version: !ruby/object:Gem::Version
-  version: 0.10.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Thomas
@@ -65,6 +65,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '7.2'
+- !ruby/object:Gem::Dependency
+  name: bcrypt_pbkdf
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.1'
+- !ruby/object:Gem::Dependency
+  name: ed25519
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: zeitwerk
   requirement: !ruby/object:Gem::Requirement
@@ -131,6 +159,7 @@ files:
 - lib/odysseus/setup/escalation.rb
 - lib/odysseus/setup/preparer.rb
 - lib/odysseus/setup/public_key.rb
+- lib/odysseus/ssh_key.rb
 - lib/odysseus/validators/config.rb
 - lib/odysseus/version_resolver.rb
 - sig/odysseus/core.rbs