mirror of
https://github.com/home-assistant/operating-system.git
synced 2026-08-14 09:13:45 +01:00
Stefan AgnerandClaude Fable 5
36d23c74b2
Debug SSH access on port 22222 currently has two lifecycle mechanisms: dropbear.service is enabled and gated by ConditionFileNotEmpty=/root/.ssh/authorized_keys at boot, and haos-config explicitly starts/stops the service when importing a CONFIG partition. Keys written through any other path - most notably os-agent's AddSSHAuthKey D-Bus method, which the Supervisor is growing an API on top of - do not start dropbear until the next reboot. Add dropbear.path, watching /root/.ssh/authorized_keys, triggering a oneshot dropbear-lifecycle.service that starts dropbear when the file is non-empty and stops it when it is absent. This makes the file the single source of truth for whether debug SSH runs, regardless of the writer, and lets haos-config drop its explicit systemctl calls. Design notes: - PathChanged= only, no PathExists=: an exists-trigger pointed at a oneshot that does not consume the file re-triggers on every deactivation until the start rate limit is hit. Boot-time presence is already handled by the enabled dropbear.service and its ConditionFileNotEmpty. - The lifecycle service is idempotent since the watch may fire for any change in the directory, including temporary files from atomic writes (rename into place is IN_MOVED_TO, which PathChanged= covers). - RequiresMountsFor=/root/.ssh orders the watch after root-.ssh.mount: inotify events do not cross mount points, so a watch armed on the shadowed rootfs inode would never fire. If the bind mount ever goes away, the directive degenerates to a no-op. - Before=haos-config.service arms the watch before the config import can write the file, closing the missed-event race on first boot. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>