akyldash/docs/operations/ACCESS.md

Infrastructure access

Discover existing access first

In a new Codex session, inspect the SSH alias and key file metadata without printing key contents, then check the connection:

ssh -F ~/.ssh/config -G akyldash_vps | awk '$1 == "hostname" || $1 == "user" || $1 == "port" || $1 == "identityfile" { print }'
test -r ~/.ssh/akyldash_codex && echo 'SSH key is available'
ssh -F ~/.ssh/config -o BatchMode=yes akyldash_vps id
ssh -F ~/.ssh/config -o BatchMode=yes akyldash_vps hostname -f
gitea-api GET /version
gitea-api GET /repos/admin/akyldash

Do not ask for the host, login, password, token, or key again before these checks. Never print a private key, token, or complete environment file.

VPS

• SSH alias: akyldash_vps, user codex, host 206.223.249.118, port 22.
• SSH configuration: ~/.ssh/config.
• Identity file: ~/.ssh/akyldash_codex (path only; never copy its contents).
• codex can run unprivileged read-only diagnostics. It has no sudo or Docker group membership; Docker CLI access to the daemon is denied. Do not add it to either group.
• Bootstrap is complete. Docker and Compose are active, but no root-owned repository checkout or restricted helper is installed yet. The owner can run infra/bootstrap/audit-host.sh from the reviewed root-owned checkout to report Docker containers/volumes, protected-file metadata, UFW rules, ports, and ISPmanager status without showing secret contents or changing state.
• Host package/service configuration, firewall changes, protected env/secret creation, backup creation, recovery apply, and production deployment require a reviewed owner/root command. infra/deploy/install-helper.sh grants the fixed verifier, read-only Compose config/status, and guarded rollback commands. It does not grant general sudo or Docker access; it is not installed on the VPS.
• infra/deploy/prepare-production-config.sh is an owner-run root operation. It refuses to overwrite existing files, copies only the tracked env example, generates a random review secret, and writes both files with mode 0600. It does not start Compose or create volumes.
• Never connect to other VPS hosts or Synology as part of this deployment.

This execution environment is WSL2. The repository is on the Windows-mounted /mnt/d filesystem, while SSH config and the identity file are in the Linux home directory. Do not assume Windows SSH credentials are available or copy keys between environments. Plain ssh akyldash_vps failed because the system SSH config include had unsafe permissions. Use ssh -F ~/.ssh/config ...; in a network-restricted session this read-only command may also require approved execution. If the key is missing in a future environment, report that limitation and do not retrieve it elsewhere.

Gitea

• Repository: https://git.vakanaut.ru/admin/akyldash.
• Use the installed gitea-api helper; it reads credentials from the environment. Never inspect local credential files, print environment values, or construct HTTP authorization headers.
• The audited API token can read/write this repository and create issues, but does not have read:user or read:package. Listing repository Actions runners returns 403 because the API principal is not the repository owner. An API 403 caused by missing scope/ownership is not evidence that no runner exists.
• Protected main requires one approval. Do not push directly to main, merge automatically, or start a review. Work on a feature branch and use a PR.
• Gitea Actions and package features are enabled for the repository. The Actions task API currently returns no runs, but runner availability and package publishing permissions have not been confirmed. The repository-level runner is prepared by infra/runner/install-runner.sh, but is not installed or registered yet. Only a repository owner may obtain its registration token in admin/akyldash Settings → Actions → Runners; do not use organization or instance tokens and never put the token in Git, a command argument, or a report. See CI_RUNNER.md.

Who can do what

Role	Operations
codex over SSH	Unprivileged diagnostics; Docker daemon, UFW rules, and protected paths require the root audit script
Restricted helpers	Read-only drift check and Compose config/status, plus guarded rollback; not installed on the audited VPS
Restricted rollback helper	Can restore prior local backend/OpenSearch images from a verified backup after an explicit data-compatibility confirmation; not installed on the audited VPS
VPS owner/root	Bootstrap, package installation, SSH/firewall, secret setup, recovery, and approval of production changes
Gitea repository writer	Feature branch push and PR creation; protected-main merge needs an approval