Skip to content

feat: Use Port IDs on Grant, Revoke SSH #397

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
drewmalin merged 6 commits into from
May 21, 2026
Merged

feat: Use Port IDs on Grant, Revoke SSH #397

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
de4153d
fix: update ssh port test
drewmalin May 19, 2026
c82da6c
fix
drewmalin May 19, 2026
48fb593
another one
drewmalin May 19, 2026
6887ca7
use port ids
drewmalin May 20, 2026
3e74c9e
lint
drewmalin May 20, 2026
e104e51
go mod tidy
drewmalin May 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -346,11 +346,11 @@ develop-with-nix:
nix develop .

.PHONY: update-devplane-deps

@drewmalin drewmalin May 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was failing to find the appropriate connect modules before.

update-devplane-deps: ## update devplane dependencies (use: make update-devplane-deps commit=<hash-or-tag>, defaults to latest)
update-devplane-deps: ## update devplane Buf modules (use: make update-devplane-deps commit=<buf-tag>, defaults to latest)
@COMMIT=$${commit:-latest}; \
echo "Updating devplane dependencies to: $$COMMIT"; \
GOPRIVATE=github.com/brevdev/* go get -u github.com/brevdev/dev-plane@$$COMMIT; \
go get buf.build/gen/go/brevdev/devplane/grpc/go@$$COMMIT; \
go get buf.build/gen/go/brevdev/devplane/connectrpc/go@$$COMMIT; \
go get buf.build/gen/go/brevdev/devplane/protocolbuffers/go@$$COMMIT; \
GOPRIVATE=github.com/brevdev/* go mod tidy; \
echo "Successfully updated to $$COMMIT"
8 changes: 4 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,9 +3,9 @@ module github.com/brevdev/brev-cli
go 1.25.0

require (
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.1-20260228021043-887d38e1b474.2
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260309172248-8105d701fdce.1
connectrpc.com/connect v1.19.1
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.2-20260520183101-9f4cb67aff2c.1
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260520183101-9f4cb67aff2c.1
Comment on lines +6 to +7

@drewmalin drewmalin May 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will update once https://github.com/brevdev/dev-plane/pull/2182 is merged.

connectrpc.com/connect v1.19.2
github.com/NVIDIA/go-nvml v0.13.0-1
github.com/alessio/shellescape v1.4.1
github.com/brevdev/parse v0.0.11
Expand Down Expand Up @@ -150,7 +150,7 @@ require (
golang.org/x/net v0.52.0 // indirect
golang.org/x/oauth2 v0.34.0 // indirect
golang.org/x/sys v0.42.0
golang.org/x/term v0.41.0 // indirect
golang.org/x/term v0.41.0
golang.org/x/time v0.12.0 // indirect
google.golang.org/protobuf v1.36.11
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.1-20260228021043-887d38e1b474.2 h1:Sq0kIa/xKzScbJcqB5EbPVhOL0QYHPr3araQaupL2lk=
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.1-20260228021043-887d38e1b474.2/go.mod h1:Yh34p9aADmWsKv2umYlMpnCZuBmNBE9N+HImgRriJXM=
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260309172248-8105d701fdce.1 h1:lWdcuXsXpMfPOer4yawjwomVbtSAnGgFAWYF8ggK9g4=
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260309172248-8105d701fdce.1/go.mod h1:V/y7Wxg0QvU4XPVwqErF5NHLobUT1QEyfgrGuQIxdPo=
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.2-20260520183101-9f4cb67aff2c.1 h1:OtdZWOk/dypzAe4bylO+TFfcw9J3Ndyeh1yylWSNgRc=
buf.build/gen/go/brevdev/devplane/connectrpc/go v1.19.2-20260520183101-9f4cb67aff2c.1/go.mod h1:eaa0R5ozu4wxcy62DEtRxO6hahJ0WuFsMAG33Zj/lVQ=
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260520183101-9f4cb67aff2c.1 h1:fDUuYv/K3h8IpEGf0uic/1/A1nBN+Vao4jzVWDRMLLc=
buf.build/gen/go/brevdev/devplane/protocolbuffers/go v1.36.11-20260520183101-9f4cb67aff2c.1/go.mod h1:V/y7Wxg0QvU4XPVwqErF5NHLobUT1QEyfgrGuQIxdPo=
buf.build/gen/go/brevdev/protoc-gen-gotag/protocolbuffers/go v1.36.11-20220906235457-8b4922735da5.1 h1:6amhprQmCKJ4wgJ6ngkh32d9V+dQcOLUZ/SfHdOnYgo=
buf.build/gen/go/brevdev/protoc-gen-gotag/protocolbuffers/go v1.36.11-20220906235457-8b4922735da5.1/go.mod h1:O+pnSHMru/naTMrm4tmpBoH3wz6PHa+R75HR7Mv8X2g=
cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
Expand Down Expand Up @@ -41,8 +41,8 @@ cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohl
cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
cloud.google.com/go/storage v1.14.0/go.mod h1:GrKmX003DSIwi9o29oFT7YDnHYwZoctc3fOKtUw0Xmo=
connectrpc.com/connect v1.19.1 h1:R5M57z05+90EfEvCY1b7hBxDVOUl45PrtXtAV2fOC14=
connectrpc.com/connect v1.19.1/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
connectrpc.com/connect v1.19.2 h1:McQ83FGdzL+t60peksi0gXC7MQ/iLKgLduAnThbM0mo=
connectrpc.com/connect v1.19.2/go.mod h1:tN20fjdGlewnSFeZxLKb0xwIZ6ozc3OQs2hTXy4du9w=
dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
Expand Down
44 changes: 16 additions & 28 deletions pkg/cmd/enablessh/enablessh.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,13 +33,15 @@ type enableSSHDeps struct {
platform externalnode.PlatformChecker
nodeClients externalnode.NodeClientFactory
registrationStore register.RegistrationStore
prompter terminal.Selector
}

func defaultEnableSSHDeps() enableSSHDeps {
return enableSSHDeps{
platform: register.LinuxPlatform{},
nodeClients: register.DefaultNodeClientFactory{},
registrationStore: register.NewFileRegistrationStore(),
prompter: register.TerminalPrompter{},
}
}

Expand Down Expand Up @@ -103,53 +105,39 @@ func enableSSH(
t.Vprintf(" Linux user: %s\n", linuxUsername)
t.Vprint("")

// Check if the node already has an SSH port allocated (e.g. for another linux user)
port, err := existingSSHPort(ctx, deps, tokenProvider, reg)

@drewmalin drewmalin May 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is not a thing anymore. We now need to ask either: do you want to open a port, or do you want to use an existing port?

node, err := fetchRegisteredNode(ctx, deps, tokenProvider, reg)
if err != nil {
t.Vprintf(" %s\n", t.Yellow(fmt.Sprintf("Warning: could not check for existing ports: %v", err)))
return fmt.Errorf("enable SSH failed: %w", err)
Comment on lines -109 to +110

@drewmalin drewmalin May 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Some of these errors just ¯\(ツ)/¯ 'd before, so tightening them to immediately fail.

}

if port != 0 {
t.Vprintf(" Using existing SSH port %d.\n", port)
} else {
t.Vprint("")
port, err = register.PromptSSHPort(t)
if err != nil {
return fmt.Errorf("invalid SSH port: %w", err)
}

if err := register.OpenSSHPort(ctx, t, deps.nodeClients, tokenProvider, reg, port); err != nil {
return fmt.Errorf("enable SSH failed: %w", err)
}
brevPortID, err := register.ResolveSSHAccessPort(ctx, t, deps.prompter, deps.nodeClients, tokenProvider, reg, node)
if err != nil {
return fmt.Errorf("enable SSH failed: %w", err)
}

if err := register.SetupAndRegisterNodeSSHAccess(ctx, t, deps.nodeClients, tokenProvider, reg, brevUser, linuxUsername); err != nil {
if err := register.SetupAndRegisterNodeSSHAccess(ctx, t, deps.nodeClients, tokenProvider, reg, brevUser, linuxUsername, brevPortID); err != nil {
return fmt.Errorf("enable SSH failed: %w", err)
}

t.Vprint(t.Green(fmt.Sprintf("SSH access enabled. You can now SSH to this device via: brev shell %s", reg.DisplayName)))
return nil
}

// existingSSHPort calls GetNode and returns the PortNumber of an already-allocated
// SSH port, or 0 if none exists
func existingSSHPort(ctx context.Context, deps enableSSHDeps, tokenProvider externalnode.TokenProvider, reg *register.DeviceRegistration) (int32, error) {
func fetchRegisteredNode(
ctx context.Context,
deps enableSSHDeps,
tokenProvider externalnode.TokenProvider,
reg *register.DeviceRegistration,
) (*nodev1.ExternalNode, error) {
client := deps.nodeClients.NewNodeClient(tokenProvider, config.GlobalConfig.GetBrevPublicAPIURL())
resp, err := client.GetNode(ctx, connect.NewRequest(&nodev1.GetNodeRequest{
ExternalNodeId: reg.ExternalNodeID,
OrganizationId: reg.OrgID,
}))
if err != nil {
return 0, fmt.Errorf("error retrieving node: %w", err)
}

for _, p := range resp.Msg.GetExternalNode().GetPorts() {
// TODO if we ever allow more than one SSH port, this should be modified
if p.GetProtocol() == nodev1.PortProtocol_PORT_PROTOCOL_SSH {
return p.GetPortNumber(), nil
}
Comment on lines -148 to -150

@drewmalin drewmalin May 20, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Core to this PR: this will now always return false, so there is no point in doing any of this checking for the SSH protocol.

return nil, fmt.Errorf("error retrieving node: %w", err)
}
return 0, nil
return resp.Msg.GetExternalNode(), nil
}

// checkSSHDaemon prints a warning if neither "ssh" nor "sshd" systemd services
Expand Down
Loading
Loading