peptide-repo/peptide-e2e
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity

fix: QA remediation P1-D + P2 for infra/vps orchestrator (v1.8.0)

Browse Source 
P1-D: bump package.json version 1.7.2 → 1.8.0 and add [1.8.0] CHANGELOG
entry documenting the infra/vps/ PRAB generation orchestrator addition.

P2 (security): replace StrictHostKeyChecking=no with StrictHostKeyChecking=accept-new
in all three SSH invocations in orchestrate-generation.sh. Add
UserKnownHostsFile=${KNOWN_HOSTS} (-o) to pin key verification to the
pre-seeded file rather than the root known_hosts.

install-orchestrator.sh: add ssh-keyscan step that pre-populates
/opt/prab-orchestrator/known_hosts with Hostinger's host key on first
install. Graceful degradation: if ssh-keyscan fails, logs WARN and
proceeds (accept-new will add the key on first real connect).

prab-generation.service: add justifying comment for User=root (root holds
the Hostinger SSH key + known_hosts in /root/.ssh/ and /opt/prab-orchestrator/).

Agent-Session: prab-reliability-remediation-20260622
This commit is contained in:
peptiderepo
2026-06-22 17:16:19 +00:00
parent d922a8368f
commit f3f579f5a8
5 changed files with 44 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
infra/vps/install-orchestrator.sh
View File

@@ -45,6 +45,21 @@ mkdir -p "${INSTALL_DIR}"
install -m 0750 "${ORCHESTRATE_SH}" "${INSTALL_DIR}/orchestrate-generation.sh"
echo " OK: ${INSTALL_DIR}/orchestrate-generation.sh"
# Pre-seed known_hosts with Hostinger's host key so ssh(1) can verify
# the server identity without StrictHostKeyChecking=no.
# ssh-keyscan output is pinned here; re-run if Hostinger rotates its key.
KNOWN_HOSTS_FILE="${INSTALL_DIR}/known_hosts"
if [[ ! -f "${KNOWN_HOSTS_FILE}" ]]; then
echo "Pre-seeding known_hosts from Hostinger (${SSH_HOST:-145.223.107.228}:${SSH_PORT:-65002})..."
ssh-keyscan -p "${SSH_PORT:-65002}" "${SSH_HOST:-145.223.107.228}" \
> "${KNOWN_HOSTS_FILE}" 2>/dev/null \
&& chmod 0600 "${KNOWN_HOSTS_FILE}" \
&& echo " OK: ${KNOWN_HOSTS_FILE}" \
|| echo " WARN: ssh-keyscan failed — known_hosts not seeded; first SSH will add key via accept-new"
else
echo " OK: ${KNOWN_HOSTS_FILE} (already exists, not overwritten)"
fi
echo "Installing systemd units..."
install -m 0644 "${SERVICE_FILE}" "${SYSTEMD_DIR}/prab-generation.service"
install -m 0644 "${TIMER_FILE}" "${SYSTEMD_DIR}/prab-generation.timer"