akyldash/docs/operations/ACCESS.md

Infrastructure access

Discover existing access first

In a new Codex session, inspect the SSH alias and key file metadata without printing key contents, then check the connection:

ssh -F ~/.ssh/config -G akyldash_vps | awk '$1 == "hostname" || $1 == "user" || $1 == "port" || $1 == "identityfile" { print }'
test -r ~/.ssh/akyldash_codex && echo 'SSH key is available'
ssh -F ~/.ssh/config -o BatchMode=yes akyldash_vps 'id; hostname'
gitea-api GET /version
gitea-api GET /repos/admin/akyldash

Do not ask for the host, login, password, token, or key again before these checks. Never print a private key, token, or complete environment file.

VPS

• SSH alias: akyldash_vps, user codex, host 206.223.249.118, port 22.
• SSH configuration: ~/.ssh/config.
• Identity file: ~/.ssh/akyldash_codex (path only; never copy its contents).
• codex can run unprivileged read-only diagnostics. The audited account has no non-interactive sudo and must not be added to sudo or the docker group.
• Host package installation, service setup, firewall changes, secret creation, backup creation, recovery apply, and deployment require owner approval and a reviewed root command. After the owner installs the root-owned repository checkout, infra/deploy/install-helper.sh can grant only the validated rollback command through sudoers; that helper is not installed on the audited VPS.
• Never connect to other VPS hosts or Synology as part of this deployment.

This execution environment's system SSH config include had unsafe file permissions, so plain ssh akyldash_vps failed. ssh -F ~/.ssh/config ... worked. Network policy may also require an approved SSH command. If the key is missing in a future execution environment, report that limitation; do not retrieve it from another machine.

Gitea

• Repository: https://git.vakanaut.ru/admin/akyldash.
• Use the installed gitea-api helper; it reads credentials from the environment. Never inspect local credential files, print environment values, or construct HTTP authorization headers.
• The audited API token can read/write this repository and create issues, but does not have read:user or read:package. An API 403 caused by a missing scope is not evidence that the account itself lacks the permission.
• Protected main requires one approval. Do not push directly to main, merge automatically, or start a review. Work on a feature branch and use a PR.
• Gitea Actions and package features are enabled for the repository, but runner availability and package publishing permissions have not been confirmed.

Who can do what

Role	Operations
codex over SSH	Read-only host diagnostics; inspect service health and public listeners
Restricted rollback helper	Can restore prior local backend/OpenSearch images from a verified backup after an explicit data-compatibility confirmation; not installed on the audited VPS
VPS owner/root	Bootstrap, package installation, SSH/firewall, secret setup, recovery, and approval of production changes
Gitea repository writer	Feature branch push and PR creation; protected-main merge needs an approval