Add detailed instructions for SSH debugging using boot-partition#3127
Add detailed instructions for SSH debugging using boot-partition#3127loeschzwerg wants to merge 7 commits into
Conversation
32d4716 to
7f3a483
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughDocumentation for Home Assistant OS developer SSH access was expanded: method-specific enable/disable instructions (USB ChangesHome Assistant OS Developer SSH Access Documentation
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (3)
docs/operating-system/debugging.md (3)
168-168: ⚡ Quick winUse descriptive link text instead of "here".
Links with "here" as anchor text reduce accessibility and scannability. Use descriptive text that indicates the destination.
♻️ Proposed improvements
### Windows -Windows instructions on how to generate and use private/public keys with Putty are found [here][windows-keys]. +Instructions for generating and using SSH keys with PuTTY on Windows are found in [this guide][windows-keys]. Instead of the droplet instructions, add the public key as per above instructions. ### Linux, WSL, etc. -Alternative instructions for Mac, Windows and Linux can be found [here](https://docs.github.com/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent). +Alternative instructions for Mac, Windows and Linux can be found in [GitHub's SSH key generation guide](https://docs.github.com/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent). Follow the steps under *Generating a new SSH key* (the other sections are not applicable to Home Assistant and can be ignored).Also applies to: 172-172
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 168, Replace the non-descriptive "here" anchor text in the sentence "Windows instructions on how to generate and use private/public keys with Putty are found [here][windows-keys]." with a descriptive link label such as "Windows PuTTY key generation and usage guide" (or similar) and update the corresponding reference [windows-keys] usage at the other occurrence (line 172) so both anchors use the new descriptive text while keeping the same link target.
37-38: ⚡ Quick winClarify the encoding requirement.
The statement "must only contain ASCII characters" and "must be ASCII-encoded (not UTF-8...)" is slightly redundant and potentially confusing, since ASCII is a 7-bit encoding and pure ASCII is a subset of UTF-8. The real concern appears to be avoiding extended character sets and ensuring compatibility with the
dropbearSSH server.♻️ Suggested clarification
-- `authorized_keys` must only contain ASCII characters -- `authorized_keys` must be ASCII-encoded (not `UTF-8`, not Windows `ISO_8859-1`). +- `authorized_keys` must contain only 7-bit ASCII characters (no extended Unicode or special characters)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` around lines 37 - 38, The two lines about authorized_keys are redundant and misleading; update the text so it clearly states that authorized_keys must contain only US-ASCII characters (bytes 0x00–0x7F) and that the file must be saved with an encoding that does not introduce non-ASCII bytes (e.g., ASCII or UTF-8 containing only ASCII bytes), and call out that this restriction ensures compatibility with the dropbear SSH server; modify the phrasing around "authorized_keys" in the doc to replace the two current bullets with a single clarified sentence referencing "authorized_keys" and "dropbear" so readers understand to avoid extended/locale encodings like ISO_8859-1 or multibyte characters.
195-195: 💤 Low valueSimplify the command to avoid unnecessary pipe.
The
cat ... | tee -apattern can be simplified to justtee -a < file, though the current form is functionally correct.♻️ Optional simplification
-cat ${SSH_FILE}.pub | tee -a authorized_keys +tee -a authorized_keys < ${SSH_FILE}.pub🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 195, Replace the unnecessary use of cat in the SSH key append command: instead of piping the public key file through cat into tee, invoke tee with input redirection from ${SSH_FILE}.pub so the public key is appended to authorized_keys more simply (target the line containing "cat ${SSH_FILE}.pub | tee -a authorized_keys" and change it to use tee -a with input redirected from ${SSH_FILE}.pub).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/operating-system/debugging.md`:
- Line 64: Fix the typo in the sentence that currently reads "dependending" in
docs/operating-system/debugging.md: locate the line containing the example mount
paths (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`) and replace
"dependending" with the correct word "depending" so the sentence reads "...at
different locations depending on your system...".
- Line 36: Update the capitalization of "MacOS" to Apple's official "macOS" in
the documentation line referencing authorized_keys; locate the sentence
containing `authorized_keys` and replace "MacOS (CR, `\r`)" with "macOS (CR,
`\r`)" so the casing is correct.
- Line 103: Text at the given line uses "installed addons" but the project
standard is "installed add‑ons"; update the phrase in the sentence "Home
Assistant itself and all installed Docker containers." (the string containing
"installed addons") to use the hyphenated form "installed add‑ons" so it matches
other occurrences like "SSH app … add-on".
- Line 165: Remove the recommendation and link to the in-browser SSH key
generator in the sentence "If you are lazy and do not expose your instance, you
could generate both keys [here]..." and replace it with a secure alternative:
delete the link and the phrase "If you are lazy...", and instead advise using
local, well-vetted tools or platform-specific official guidance for SSH key
generation (e.g., ssh-keygen or OpenSSH clients) with a short warning against
third-party/browser-based key generators; update the sentence to a neutral,
security-first recommendation referencing SSH key generation best practices.
---
Nitpick comments:
In `@docs/operating-system/debugging.md`:
- Line 168: Replace the non-descriptive "here" anchor text in the sentence
"Windows instructions on how to generate and use private/public keys with Putty
are found [here][windows-keys]." with a descriptive link label such as "Windows
PuTTY key generation and usage guide" (or similar) and update the corresponding
reference [windows-keys] usage at the other occurrence (line 172) so both
anchors use the new descriptive text while keeping the same link target.
- Around line 37-38: The two lines about authorized_keys are redundant and
misleading; update the text so it clearly states that authorized_keys must
contain only US-ASCII characters (bytes 0x00–0x7F) and that the file must be
saved with an encoding that does not introduce non-ASCII bytes (e.g., ASCII or
UTF-8 containing only ASCII bytes), and call out that this restriction ensures
compatibility with the dropbear SSH server; modify the phrasing around
"authorized_keys" in the doc to replace the two current bullets with a single
clarified sentence referencing "authorized_keys" and "dropbear" so readers
understand to avoid extended/locale encodings like ISO_8859-1 or multibyte
characters.
- Line 195: Replace the unnecessary use of cat in the SSH key append command:
instead of piping the public key file through cat into tee, invoke tee with
input redirection from ${SSH_FILE}.pub so the public key is appended to
authorized_keys more simply (target the line containing "cat ${SSH_FILE}.pub |
tee -a authorized_keys" and change it to use tee -a with input redirected from
${SSH_FILE}.pub).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 335b90f9-be73-4558-9397-d2dc978ace18
📒 Files selected for processing (1)
docs/operating-system/debugging.md
There was a problem hiding this comment.
♻️ Duplicate comments (3)
docs/operating-system/debugging.md (3)
64-64:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winFix the typo.
"dependending" should be "depending".
📝 Proposed fix
- - The partition is auto-mounted at different locations dependending on your system (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`). + - The partition is auto-mounted at different locations depending on your system (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 64, There's a typo in the sentence containing "dependending" — locate the sentence that reads "The partition is auto-mounted at different locations dependending on your system (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`)." and replace the misspelled word "dependending" with "depending" so the sentence reads "...at different locations depending on your system...".
165-165:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove the recommendation for browser-based key generation.
Recommending a third-party in-browser SSH key generator is a significant security risk, even if the generation happens client-side. This practice should not be endorsed in official developer documentation, as it normalizes poor security hygiene and exposes developers to potential key compromise. The statement "If you are lazy and do not expose your instance" downplays real security risks.
🔒 Proposed fix
Key filenames are inconsequential, and only identify the correct key. -If you are lazy and do not expose your instance, you could generate both keys [here](https://inbrowser.app/tools/ssh-key-generator/).🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 165, Remove the sentence recommending the in-browser SSH key generator and replace it with a brief, secure alternative: instruct readers to generate SSH keys locally using standard tools (e.g., ssh-keygen on Linux/macOS, PowerShell's New-SshKey/ssh-keygen on Windows, or their OS's official GUI key tool) and warn explicitly against using third-party web-based key generators; update the line that currently reads "If you are lazy and do not expose your instance, you could generate both keys [here]..." to a short, security-minded sentence guiding local key generation and discouraging browser-based generators.
103-103:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winFix "installed addons" → "installed add-ons" terminology.
The documentation uses the hyphenated form "add-on" / "add-ons" elsewhere (e.g., line 8 "SSH app (formerly known as an add-on)"), but line 103 says "installed addons". Change to "installed add-ons" for consistency with Home Assistant's standard terminology.
📝 Proposed fix
-Home Assistant itself and all installed addons run in separate Docker containers. +Home Assistant itself and all installed add-ons run in separate Docker containers.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 103, Replace the phrase "installed addons" in the sentence "Home Assistant itself and all installed addons run in separate Docker containers." with the hyphenated form "installed add‑ons" so it matches the project's consistent terminology ("add‑on"/"add‑ons") used elsewhere; update that exact string in the docs/operating-system/debugging.md content to "Home Assistant itself and all installed add‑ons run in separate Docker containers." ensuring spelling and hyphenation are consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@docs/operating-system/debugging.md`:
- Line 64: There's a typo in the sentence containing "dependending" — locate the
sentence that reads "The partition is auto-mounted at different locations
dependending on your system (e.g. `/run/media/USER/hassos-boot` or
`/mnt/hassos-boot`)." and replace the misspelled word "dependending" with
"depending" so the sentence reads "...at different locations depending on your
system...".
- Line 165: Remove the sentence recommending the in-browser SSH key generator
and replace it with a brief, secure alternative: instruct readers to generate
SSH keys locally using standard tools (e.g., ssh-keygen on Linux/macOS,
PowerShell's New-SshKey/ssh-keygen on Windows, or their OS's official GUI key
tool) and warn explicitly against using third-party web-based key generators;
update the line that currently reads "If you are lazy and do not expose your
instance, you could generate both keys [here]..." to a short, security-minded
sentence guiding local key generation and discouraging browser-based generators.
- Line 103: Replace the phrase "installed addons" in the sentence "Home
Assistant itself and all installed addons run in separate Docker containers."
with the hyphenated form "installed add‑ons" so it matches the project's
consistent terminology ("add‑on"/"add‑ons") used elsewhere; update that exact
string in the docs/operating-system/debugging.md content to "Home Assistant
itself and all installed add‑ons run in separate Docker containers." ensuring
spelling and hyphenation are consistent.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 2b4d294a-8d1f-417c-aa86-2d2670d29635
📒 Files selected for processing (1)
docs/operating-system/debugging.md
This commit adds detailed instructions for using the /boot/CONFIG method to setup the SSH server. It also details an example workflow to setup the debugging SSH session effortlessly.
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
docs/operating-system/debugging.md (1)
165-165: 💤 Low valueRephrase "inconsequential" for accuracy.
"Key filenames are inconsequential" is misleading—filenames are important for identifying which key to use. Consider: "Key filenames are not restricted by technical requirements, but should be descriptive to identify the correct key."
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 165, The sentence "Key filenames are inconsequential" is misleading; update the phrasing to clarify that filenames aren't technically constrained but should be descriptive—for example replace that sentence with "Key filenames are not restricted by technical requirements, but should be descriptive to identify the correct key" (locate the exact phrase "Key filenames are inconsequential" in the debugging.md content and swap it for the suggested rewording).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/operating-system/debugging.md`:
- Line 75: Edit the sentence that currently reads "Be aware, that _open & close_
can modify a file, e.g. when Auto-Save is on, which can mess with the encoding":
remove the unnecessary comma after "aware", replace "_open & close_" with
"opening and closing a file", and improve clarity by using "e.g., when Auto-Save
is enabled" and "can corrupt the encoding" (resulting in wording like: "Be aware
that opening and closing a file can modify it (e.g., when Auto-Save is enabled),
which can corrupt the encoding.").
- Around line 200-201: The current steps create/append a local authorized_keys
file in the working directory then copy it to ${MOUNT_PATH}/CONFIG, which can
unintentionally modify or leave a file in CWD; instead write the public key
directly to the target path. Replace the two-step sequence that uses "cat
${SSH_FILE}.pub | tee -a authorized_keys" and "sudo cp authorized_keys
${MOUNT_PATH}/CONFIG" with a single operation that appends/writes directly to
the target (e.g., using ${MOUNT_PATH}/CONFIG/authorized_keys with tee or
redirection and sudo as needed) so no temporary authorized_keys is created in
the current directory.
---
Nitpick comments:
In `@docs/operating-system/debugging.md`:
- Line 165: The sentence "Key filenames are inconsequential" is misleading;
update the phrasing to clarify that filenames aren't technically constrained but
should be descriptive—for example replace that sentence with "Key filenames are
not restricted by technical requirements, but should be descriptive to identify
the correct key" (locate the exact phrase "Key filenames are inconsequential" in
the debugging.md content and swap it for the suggested rewording).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 47fcc450-ba97-4792-a28a-2054721f1496
📒 Files selected for processing (1)
docs/operating-system/debugging.md
Visual layouts are easier to understand than textual descriptions, if suitable.
Multiple Tip, Info, Warning, Caution boxes reduce the perceived importance of the warning box.
increases source markdown readability (unrendered)
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
docs/operating-system/debugging.md (2)
75-75:⚠️ Potential issue | 🟡 Minor | ⚡ Quick winTighten grammar for clarity in the warning sentence.
“Be aware, that open & close can modify a file...” is grammatically awkward and less clear than needed for a safety-critical warning. Use “Be aware that opening and closing a file...” phrasing.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 75, Replace the awkward sentence "Be aware, that _open & close_ can modify a file, e.g. when Auto-Save is on, which can mess with the encoding" with a clearer grammatical warning: "Be aware that opening and closing a file can modify it, e.g. when Auto-Save is on, which can mess with the encoding." Change "_open & close_" to "opening and closing a file", remove the comma after "Be aware", replace "&" with "and", and use "it" instead of repeating "a file" for clarity.
170-170:⚠️ Potential issue | 🟠 Major | ⚡ Quick winRemove browser-based SSH key generator recommendation from official guidance.
Even with a “discouraged” label, linking a third-party in-browser key generator in core developer docs weakens the security posture and normalizes risky key handling patterns. Keep the guidance to local, trusted tools (
ssh-keygen,PuTTYgen) only.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@docs/operating-system/debugging.md` at line 170, Remove the inbrowser.app in-browser SSH key generator recommendation by deleting the list item that contains "[inbrowser.app](https://inbrowser.app/tools/ssh-key-generator/)" and replace or reword the sentence to only recommend generating SSH keys with local, trusted tools such as ssh-keygen or PuTTYgen; ensure no third-party browser-based key generators are referenced in the SSH key generation section.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@docs/operating-system/debugging.md`:
- Around line 110-115: Split the mixed instructions into two clear subsections:
"Disable via Method 1 (USB drive)" and "Disable via Method 2 (hassos-boot
partition)"; under Method 1, describe using a USB partition named CONFIG (case
sensitive), removing any root-level authorized_keys on that USB, and that
rebooting with CONFIG present but without authorized_keys will remove SSH keys
and disable port 22222; under Method 2, describe deleting
/CONFIG/authorized_keys on the hassos-boot partition only (keeping CONFIG), and
state the reboot behavior for that method separately; ensure you reference the
exact symbols CONFIG, /CONFIG/authorized_keys and hassos-boot in each subsection
so readers cannot confuse the methods.
- Line 38: Update the contradictory guidance about authorized_keys: replace the
current claim that it "must be ASCII-encoded (not UTF-8)" with a clear statement
that the file should be plain-text with UTF-8/ASCII-compatible encoding (ASCII
bytes are valid within UTF-8), contain only ASCII key material, and use LF line
endings; refer explicitly to the authorized_keys filename in the text so readers
know to ensure plain-text UTF-8/ASCII compatibility and LF newlines rather than
forbidding UTF-8 outright.
---
Duplicate comments:
In `@docs/operating-system/debugging.md`:
- Line 75: Replace the awkward sentence "Be aware, that _open & close_ can
modify a file, e.g. when Auto-Save is on, which can mess with the encoding" with
a clearer grammatical warning: "Be aware that opening and closing a file can
modify it, e.g. when Auto-Save is on, which can mess with the encoding." Change
"_open & close_" to "opening and closing a file", remove the comma after "Be
aware", replace "&" with "and", and use "it" instead of repeating "a file" for
clarity.
- Line 170: Remove the inbrowser.app in-browser SSH key generator recommendation
by deleting the list item that contains
"[inbrowser.app](https://inbrowser.app/tools/ssh-key-generator/)" and replace or
reword the sentence to only recommend generating SSH keys with local, trusted
tools such as ssh-keygen or PuTTYgen; ensure no third-party browser-based key
generators are referenced in the SSH key generation section.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: f859ebc2-721f-4f69-b471-920a91f3b75e
📒 Files selected for processing (1)
docs/operating-system/debugging.md
| 1. Use a USB drive with a partition named `CONFIG` (case sensitive) formatted as FAT, ext4, or NTFS. | ||
| Remove any existing `authorized_keys` file from the root of that partition. | ||
| Using method 2, delete the file `/CONFIG/authorized_keys` on the partition `hassos-boot`, while keeping `CONFIG`. | ||
|
|
||
| 1. When the Home Assistant OS device is rebooted with this drive inserted, any existing SSH public keys will be removed and SSH access on port 22222 will be disabled. | ||
| 2. When the Home Assistant OS device reboots with a present `CONFIG` without `authorized_keys`, any existing SSH public keys will be removed and SSH access on port 22222 will be disabled. | ||
|
|
There was a problem hiding this comment.
Split disable instructions by method to avoid accidental misuse.
This block starts with USB-drive instructions and then immediately injects method-2 (hassos-boot) actions in the same numbered flow. That conflicts with your earlier “do not mix method 1 and 2” warning and makes disable steps easy to apply incorrectly.
Please separate into two explicit subsections (Disable via Method 1 / Disable via Method 2) with isolated reboot behavior per method.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@docs/operating-system/debugging.md` around lines 110 - 115, Split the mixed
instructions into two clear subsections: "Disable via Method 1 (USB drive)" and
"Disable via Method 2 (hassos-boot partition)"; under Method 1, describe using a
USB partition named CONFIG (case sensitive), removing any root-level
authorized_keys on that USB, and that rebooting with CONFIG present but without
authorized_keys will remove SSH keys and disable port 22222; under Method 2,
describe deleting /CONFIG/authorized_keys on the hassos-boot partition only
(keeping CONFIG), and state the reboot behavior for that method separately;
ensure you reference the exact symbols CONFIG, /CONFIG/authorized_keys and
hassos-boot in each subsection so readers cannot confuse the methods.
There was a problem hiding this comment.
So basically what the partition layout below states. Wouldn't it be better to replace it with the layouts then?
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
Length of output: 91
🏁 Script executed:
Length of output: 91
Here are the results from shell you requested:
Shell block treated as final reply content because the matching action tag was not present.
Here are the results from shell you requested:
Shell block treated as final reply content because the matching action tag was not present.
I wanted to find out how the SSH server on port 22222 was actually spawned.
But the process of mounting a USB-Stick never worked for me.
In consequence, I wanted to change it on the boot partition/systemd-Unit level.
I found that my preference is already implemented.
As this documentation was quite frankly rather unclear to me, I propose an overhaul to this documentation.
It should allow most developers to get up and running much faster than fiddling on a headless instance with a USB-Stick.
This PR reworks the existing SSH debugging guide for port 22222.
It adds detailed instructions for method 2 (/boot/CONFIG) to setup the SSH server.
It also details an example workflow to setup the debugging SSH session effortlessly.
Proposed change
Type of change
Checklist
Additional information
/usr/sbin/hassos-configSummary by CodeRabbit