mirror of
https://github.com/Termix-SSH/Termix.git
synced 2026-10-28 22:25:24 +00:00
35 lines
1.3 KiB
Markdown
35 lines
1.3 KiB
Markdown
# OPKSSH
|
|
|
|
Adds the `opkssh` SSH auth type: Termix signs you in with your identity
|
|
provider in the browser, gets a short-lived SSH certificate from
|
|
[OpenPubkey SSH](https://github.com/openpubkey/opkssh), and caches it for 24
|
|
hours.
|
|
|
|
## Config
|
|
|
|
`<DATA_DIR>/plugins/opkssh/config.yml`, OPKSSH's own config format. A
|
|
template is written there the first time someone signs in without one. An
|
|
install upgraded from 2.8 has its old `<DATA_DIR>/.opk/config.yml` copied
|
|
here.
|
|
|
|
`redirect_uris` in that file are OPKSSH's local listener on the Termix
|
|
server and must be localhost (or left out). The public callback is passed
|
|
to OPKSSH as `--remote-redirect-uri`; register it with your identity
|
|
provider. The plugin's admin settings page shows it:
|
|
`<base URL>/plugin-api/opkssh/callback`, or `<base URL>/host/opkssh-callback`
|
|
while "Use the old redirect URI" is on.
|
|
|
|
## Binary
|
|
|
|
The plugin runs `opkssh` pinned to one release and its SHA-256. It looks, in
|
|
order, at:
|
|
|
|
1. `OPKSSH_BUNDLED_DIR/<asset>` (default `<cwd>/opkssh-bundled`). The Docker
|
|
image bakes the binary into `/app/opkssh-bundled`, so offline installs
|
|
never download it.
|
|
2. `<DATA_DIR>/plugins/opkssh/bin/<asset>`, a copy downloaded earlier.
|
|
3. A download from the GitHub release.
|
|
|
|
Any copy whose checksum does not match is ignored. `OPKSSH_VERSION` picks
|
|
another release; `OPKSSH_SHA256` must then give its checksum.
|