Frontdoor — SSH-only Workspaces + Key Management

user delete cron cleanup

Khi key bị revoke → sync ngay (loại key khỏi authorized_keys của tất cả workspace). User đăng nhập tiếp bằng key khác (nếu có), hoặc bị khoá ra ngoài (nếu key cuối cùng).

Guard: UI cảnh báo "đây là key cuối cùng — bạn sẽ bị khoá ra ngoài workspace, tiếp tục?" trước khi cho xoá.

5. Database schema

Migration 0005_ssh_keys.sql

CREATE TABLE ssh_keys (
  id              INTEGER PRIMARY KEY AUTOINCREMENT,
  owner_email     TEXT    NOT NULL,
  name            TEXT    NOT NULL,                 -- "laptop", "mac mini", "phone"
  public_key      TEXT    NOT NULL,                 -- toàn bộ "ssh-ed25519 AAAA... comment"
  fingerprint     TEXT    NOT NULL UNIQUE,          -- sha256 fingerprint, unique cluster
  key_type        TEXT    NOT NULL,                 -- ed25519 | rsa | ecdsa
  comment         TEXT,
  created_at      INTEGER NOT NULL DEFAULT (unixepoch()),
  last_used_at    INTEGER                            -- updated by agent on successful ssh
);
CREATE INDEX idx_ssh_keys_owner ON ssh_keys(owner_email);

-- Per-workspace sync state — track xem 1 workspace đã sync chưa.
-- Khi workspace.state='running' và last_synced_at < max(ssh_keys.created_at) → cần re-sync.
CREATE TABLE workspace_key_sync (
  workspace_name  TEXT    PRIMARY KEY REFERENCES workspaces(name) ON DELETE CASCADE,
  last_synced_at  INTEGER NOT NULL,
  key_count       INTEGER NOT NULL DEFAULT 0,
  last_error      TEXT
);

-- Audit log (extends audit_log existing)
-- Không cần bảng mới — dùng existing audit_log với action='ssh-key-add', 'ssh-key-revoke', 'ssh-key-sync'

Sample row

id          | 1
owner_email | giangm9@gmail.com
name        | laptop-m4
public_key  | ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK... giang@macbook
fingerprint | SHA256:abc123def456...
key_type    | ed25519
comment     | giang@macbook

6. API endpoints

Admin / UI (CF Access JWT — giangm9@gmail.com)

Agent jobs mới

Lưu ý: dùng cơ chế jobs table sẵn có (workspace path) — không liên quan batch queue.

7. Image mới (custom workspace image)

image/Dockerfile

FROM ubuntu:24.04

ENV DEBIAN_FRONTEND=noninteractive

RUN apt-get update && apt-get install -y --no-install-recommends \
    openssh-server sudo curl wget git ca-certificates gnupg lsb-release \
    build-essential python3 python3-pip python3-venv \
    nodejs npm \
    tmux htop vim nano less jq ripgrep fd-find \
    zsh \
    && rm -rf /var/lib/apt/lists/*

# Node 22 + pnpm (replaces apt nodejs which is old)
RUN curl -fsSL https://deb.nodesource.com/setup_22.x | bash - \
    && apt-get install -y nodejs \
    && npm install -g pnpm@9

# AWS CLI
RUN curl -fsSL "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o /tmp/aws.zip \
    && unzip /tmp/aws.zip -d /tmp && /tmp/aws/install && rm -rf /tmp/aws*

# GitHub CLI
RUN curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg \
      | dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg \
    && echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" \
      > /etc/apt/sources.list.d/github-cli.list \
    && apt-get update && apt-get install -y gh

# Claude Code CLI
RUN npm install -g @anthropic-ai/claude-code

# sshd config
RUN mkdir /var/run/sshd /root/.ssh \
    && chmod 700 /root/.ssh \
    && touch /root/.ssh/authorized_keys \
    && chmod 600 /root/.ssh/authorized_keys

# Disable password auth — key only
RUN sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config \
    && sed -i 's/^#*PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config \
    && sed -i 's/^#*ChallengeResponseAuthentication.*/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config

# Default shell zsh, no oh-my-zsh (clean)
RUN chsh -s /bin/zsh root

# Generate host keys at first run via entrypoint (so each container has unique keys)
COPY entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh

EXPOSE 22
ENTRYPOINT ["/entrypoint.sh"]
CMD ["/usr/sbin/sshd", "-D", "-e"]

image/entrypoint.sh

#!/usr/bin/env bash
set -e
# Generate host keys on first start (persisted via volume on /etc/ssh)
if [ ! -f /etc/ssh/ssh_host_ed25519_key ]; then
  ssh-keygen -A
fi
exec "$@"

Sự khác biệt so với image cũ

8. Routing thay đổi

Hiện tại (HTTP only)

*.6iang.com → CF Tunnel → Traefik :80 → container:8080 (code-server)

Mới (SSH qua CF Access)

*.6iang.com → CF Tunnel → workspace:22 (sshd)

Client: cloudflared access ssh --hostname X.6iang.com
        ↓ WSS to CF edge
        ↓ CF verifies Access JWT (email OTP)
        ↓ short-lived SSH cert exchange
        ↓ tunneled TCP → tunnel exit → host → sshd

Hai cách expose port 22 từ container đến tunnel

Đề xuất B: một tunnel, dynamic ingress. Agent cập nhật config.yml của cloudflared khi workspace lifecycle thay đổi:

# /etc/cloudflared/config.yml (managed by agent)
tunnel: 8fca8440-...
credentials-file: /etc/cloudflared/cert.json

ingress:
  - hostname: dev.6iang.com
    service: ssh://172.20.0.5:22
  - hostname: work.6iang.com
    service: ssh://172.20.0.6:22
  - hostname: frontdoor.6iang.com
    service: https://frontdoor-preview.pages.dev
  - service: http_status:404

Sau mỗi update: cloudflared tunnel ingress validate && supervisorctl reload cloudflared (hoặc docker exec cloudflared kill -HUP 1).

Alternative đơn giản hơn: Cloudflared hỗ trợ chế độ "single-service per hostname" — set ingress wildcard:

- hostname: "*.6iang.com"
  service: ssh://traefik:22

nhưng Traefik không route SSH theo hostname được. Vậy phải duy trì ingress list dynamic (cách B). Việc này bản thân là 1 thay đổi không nhỏ → cần đưa vào agent job: updateTunnelIngress.

9. Workspace lifecycle thay đổi

Khi tạo workspace mới:

Control plane Agent Docker cloudflared D1

Workspaces
Monitor
Volumes
SSH Keys        ← mới
Settings

┌───────────────────────────────────────────────────────────────────┐
│  SSH Keys                                  [+ Add key] [Sync all] │
├───────────────────────────────────────────────────────────────────┤
│  laptop-m4                                                        │
│    SHA256:abc123def456…  ed25519  added 3d ago  last used 2h ago  │
│    "giang@macbook"                                  [Revoke]      │
├───────────────────────────────────────────────────────────────────┤
│  mac-mini-server                                                  │
│    SHA256:xyz789…       ed25519  added 1w ago  never used         │
│                                                     [Revoke]      │
├───────────────────────────────────────────────────────────────────┤
│  phone-termius                                                    │
│    SHA256:def456…       rsa-3072 added 2w ago  last used 5d ago   │
│                                                     [Revoke]      │
└───────────────────────────────────────────────────────────────────┘

Sync status:
  ✓ dev      synced 2m ago  (3 keys)
  ✓ work     synced 2m ago  (3 keys)
  ⚠ archive  synced 1d ago  (2 keys) — needs sync
                                              [Sync archive]

Name        [____________________]  e.g. "laptop"
Public key  [____________________]
            [____________________]
            [____________________]
            paste your ~/.ssh/id_ed25519.pub here

Detected:   ed25519 · SHA256:abc...
            (sẽ tự động sync vào all running workspaces)

                                  [Cancel] [Add & Sync]

┌──────────────────────────────┐
│  ⚙ dev                       │
│  CPU 0.3%  Mem 412 MB        │
│                              │
│  ssh dev.6iang.com           │
│  [📋 Copy]   [⚙ Settings]     │
└──────────────────────────────┘

# 1. Install cloudflared
brew install cloudflared        # macOS
# hoặc: https://github.com/cloudflare/cloudflared/releases

# 2. Configure SSH (paste vào ~/.ssh/config)
Host *.6iang.com
  User root
  ProxyCommand /usr/local/bin/cloudflared access ssh --hostname %h
  IdentityFile ~/.ssh/id_ed25519

# 3. Authenticate (one-time, opens browser)
cloudflared access login https://6iang.com

# 4. Done — test:
ssh dev.6iang.com