Adds the opkssh SSH auth type: Termix signs you in with your identity provider in the browser, gets a short-lived SSH certificate from OpenPubkey SSH, and caches it for 24 hours.

Config

<DATA_DIR>/plugins/opkssh/config.yml, OPKSSH's own config format. A template is written there the first time someone signs in without one. An install upgraded from 2.8 has its old <DATA_DIR>/.opk/config.yml copied here.

redirect_uris in that file are OPKSSH's local listener on the Termix server and must be localhost (or left out). The public callback is passed to OPKSSH as --remote-redirect-uri; register it with your identity provider. The plugin's admin settings page shows it: <base URL>/plugin-api/opkssh/callback, or <base URL>/host/opkssh-callback while "Use the old redirect URI" is on.

Binary

The plugin runs opkssh pinned to one release and its SHA-256. It looks, in order, at:

OPKSSH_BUNDLED_DIR/<asset> (default <cwd>/opkssh-bundled). The Docker image bakes the binary into /app/opkssh-bundled, so offline installs never download it.
<DATA_DIR>/plugins/opkssh/bin/<asset>, a copy downloaded earlier.
A download from the GitHub release.

Any copy whose checksum does not match is ignored. OPKSSH_VERSION picks another release; OPKSSH_SHA256 must then give its checksum.