Skip to content

RUNBOOK: SSH to the box is over Tailscale only; port 22 closed publicly #63

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeffcrouse merged 1 commit into from
Oct 3, 2026
Merged

RUNBOOK: SSH to the box is over Tailscale only; port 22 closed publicly #63

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions packages/server/deploy/RUNBOOK.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ The instance uses Lightsail's default key pair, which you may never have
downloaded. Fetch it rather than hunting for it:

```bash
aws lightsail download-default-key-pair --profile admin --region us-east-1 \
aws lightsail download-default-key-pair --profile jeff --region us-east-1 \
--query 'privateKeyBase64' --output text > ~/.ssh/clapback-lightsail.pem
chmod 600 ~/.ssh/clapback-lightsail.pem
```
Expand Down Expand Up @@ -199,10 +199,35 @@ on the instance. So administration is a tunnel, and needs SSH — which is the
point: anyone who can reach it already owns the box.

```bash
ssh -i ~/.ssh/clapback-lightsail.pem -L 8000:127.0.0.1:8000 ubuntu@clapback.seethroughlab.com
ssh -L 8000:127.0.0.1:8000 clapback # over Tailscale; see 6c
# then, locally: http://127.0.0.1:8000/admin
```

## 6c. SSH is over Tailscale only

Since 2026-10-02 the instance's public firewall opens **80 and 443 only**; port 22
is reachable only over the tailnet, where the instance is `clapback`
(100.83.113.16, key expiry disabled). `~/.ssh/config` on jeffbook has a `Host
clapback` entry carrying the user, the key and `HostKeyAlias
clapback.seethroughlab.com`, so the host key trusted before the move still applies.
Every `ssh … ubuntu@clapback.seethroughlab.com` in this runbook is now `ssh clapback`
— except on a freshly provisioned box (section 3), which is not on the tailnet yet:
install Tailscale there (`curl -fsSL https://tailscale.com/install.sh | sh && sudo
tailscale up --hostname=clapback`, then disable key expiry in the admin console)
before closing 22.

**If Tailscale is down on the box**, reopen 22 for as long as the repair takes, and
close it again after:

```bash
aws lightsail open-instance-public-ports --profile jeff --region us-east-1 \
--instance-name clapback --port-info fromPort=22,toPort=22,protocol=tcp,cidrs=$(curl -s https://checkip.amazonaws.com)/32
aws lightsail close-instance-public-ports --profile jeff --region us-east-1 \
--instance-name clapback --port-info fromPort=22,toPort=22,protocol=tcp
```

Lightsail's browser SSH console also needs 22 open, so it is not a way around this.

`CACHE_ADMIN_PASSWORD` is not recovered from anywhere — it is an environment
variable compared with `secrets.compare_digest`, stored in no database, so a new
deployment chooses a new one. `openssl rand -base64 24`.
Expand Down
Loading