SSH Keys

Manage SSH keys for secure authentication with Git providers and remote server access.

Overview

SSH keys in sh0 serve two primary purposes:

• Git provider authentication: Clone private repositories from GitHub, GitLab, Bitbucket, or any Git server that supports SSH.
• Remote server access: Connect to remote nodes in a multi-server setup via SSH tunnels.

sh0 stores SSH private keys encrypted at rest using AES-256-GCM. Keys are only decrypted in memory when needed for authentication.

Generating an SSH Key Pair

If you do not have an SSH key pair, generate one using the following command. sh0 supports Ed25519 (recommended) and RSA keys.

Ed25519 (recommended):

ssh-keygen -t ed25519 -C "sh0-deploy-key" -f ~/.ssh/sh0_deploy

RSA (4096-bit):

ssh-keygen -t rsa -b 4096 -C "sh0-deploy-key" -f ~/.ssh/sh0_deploy

This creates two files:

• ~/.ssh/sh0_deploy -- the private key (keep this secret)
• ~/.ssh/sh0_deploy.pub -- the public key (safe to share)

Adding SSH Keys to sh0

You can add SSH keys through the dashboard or the API.

Via the Dashboard:

1. Navigate to Settings → SSH Keys.
2. Click Add SSH Key.
3. Enter a descriptive name (e.g., "GitHub Deploy Key").
4. Paste the contents of your private key file.
5. Click Save.

Via the API:

curl -X POST https://your-server:9000/api/ssh-keys \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "GitHub Deploy Key",
    "private_key": "-----BEGIN OPENSSH PRIVATE KEY-----\\n...\\n-----END OPENSSH PRIVATE KEY-----"
  }'

SSH Keys for Git Providers

To deploy from private repositories, sh0 needs an SSH key that has read access to the repository. Here is how to set it up for common providers:

GitHub:

1. Go to your repository → Settings → Deploy Keys.
2. Click Add deploy key.
3. Paste the contents of your public key (.pub file).
4. Leave "Allow write access" unchecked (sh0 only needs read access).

GitLab:

1. Go to your project → Settings → Repository → Deploy Keys.
2. Add a new deploy key with your public key.
3. Grant read-only access.

Bitbucket:

1. Go to your repository → Settings → Access keys.
2. Click Add key and paste your public key.

SSH Keys for Server Access

When adding remote nodes to a multi-server setup, sh0 uses SSH keys to establish secure tunnels. The key must be authorized on the remote server.

1. Add the SSH key to sh0 (as described above).
2. Copy the public key to the remote server's ~/.ssh/authorized_keys file:

ssh-copy-id -i ~/.ssh/sh0_deploy.pub deploy@remote-server

When adding the node in sh0, select this SSH key for authentication. sh0 will use it to establish the SSH tunnel to the remote Docker daemon.

Key Fingerprints

Each SSH key has a unique fingerprint that you can use to verify its identity. sh0 displays the SHA-256 fingerprint for each stored key.

# View the fingerprint of a local key file
ssh-keygen -lf ~/.ssh/sh0_deploy.pub

Compare this fingerprint with the one shown in the sh0 dashboard to verify you have uploaded the correct key.

Managing Multiple Keys

The SSH Keys panel lists all keys stored in sh0. For each key, you can see:

• Key name and fingerprint
• Key type (Ed25519, RSA)
• Date added
• Which apps or nodes use the key

Removing Keys

To remove an SSH key from sh0:

1. Navigate to Settings → SSH Keys.
2. Click the delete icon next to the key you want to remove.
3. Confirm the deletion.

curl -X DELETE https://your-server:9000/api/ssh-keys/key_abc123 \
  -H "Authorization: Bearer YOUR_TOKEN"