Skip to content

Add detailed instructions for SSH debugging using boot-partition#3127

Open
loeschzwerg wants to merge 7 commits into
home-assistant:masterfrom
loeschzwerg:patch-1
Open

Add detailed instructions for SSH debugging using boot-partition#3127
loeschzwerg wants to merge 7 commits into
home-assistant:masterfrom
loeschzwerg:patch-1

Conversation

@loeschzwerg

@loeschzwerg loeschzwerg commented May 29, 2026

Copy link
Copy Markdown

I wanted to find out how the SSH server on port 22222 was actually spawned.
But the process of mounting a USB-Stick never worked for me.
In consequence, I wanted to change it on the boot partition/systemd-Unit level.
I found that my preference is already implemented.
As this documentation was quite frankly rather unclear to me, I propose an overhaul to this documentation.
It should allow most developers to get up and running much faster than fiddling on a headless instance with a USB-Stick.

This PR reworks the existing SSH debugging guide for port 22222.
It adds detailed instructions for method 2 (/boot/CONFIG) to setup the SSH server.
It also details an example workflow to setup the debugging SSH session effortlessly.

Proposed change

  1. Adds the currently undocumented alternative, but less error-prone SSH activation method. It does not require USB-Stick mounting during the boot process (which requires headless mounting of often buggy hardware).
  2. Adds an end-to-end example workflow to setup the required files, using the boot-CONFIG method, including SSH-client configuration.
  3. Overhauls the documentation for improved clarity and structure with visual examples.

Type of change

  • Document existing features within Home Assistant
  • Document new or changing features for which there is an existing pull request elsewhere
  • Spelling or grammatical corrections, or rewording for improved clarity
  • Editing or restructuring documentation guidelines
  • Changes to the backend of this documentation
  • Remove stale or deprecated documentation

Checklist

  • I have read and followed the documentation guidelines.
  • I have verified that my changes render correctly in the documentation.

Additional information

  • Link to relevant existing code or pull request:
  1. Debugging
  2. /usr/sbin/hassos-config

Summary by CodeRabbit

  • Documentation
    • Expanded and restructured SSH access guide with clear, step-by-step enable/disable procedures and separate method-specific flows.
    • Added prominent info/warning callouts outlining risks and safe usage rules.
    • Added a dedicated key-generation section with recommended key naming, platform links, concrete example workflows, sample layout illustrations, and explicit instructions for disabling access.

@loeschzwerg
loeschzwerg force-pushed the patch-1 branch 2 times, most recently from 32d4716 to 7f3a483 Compare June 1, 2026 18:04
@loeschzwerg
loeschzwerg marked this pull request as ready for review June 1, 2026 18:15
@coderabbitai

coderabbitai Bot commented Jun 1, 2026

Copy link
Copy Markdown
Contributor

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Documentation for Home Assistant OS developer SSH access was expanded: method-specific enable/disable instructions (USB CONFIG and hassos-boot) with authorized_keys encoding/newline rules, plus a new "Generating SSH Keys" section and an Example Workflow with concrete commands and SSH config examples.

Changes

Home Assistant OS Developer SSH Access Documentation

Layer / File(s) Summary
Enable / disable SSH (method-specific)
docs/operating-system/debugging.md
Rewrote SSH enablement/disablement into two distinct developer-only flows: USB-drive CONFIG and hassos-boot. Each flow includes exact authorized_keys formatting/encoding/newline constraints and partition-layout examples for enabling and disabling SSH on port 22222.
SSH key generation and example workflow
docs/operating-system/debugging.md
New "Generating SSH Keys" section recommending a dedicated id_hassos key pair and using only the public key in authorized_keys. Added an "Example Workflow" with concrete mount/write commands, an ssh config example using IdentityFile, and a directory/layout illustration.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title directly and clearly summarizes the main change: adding detailed SSH debugging instructions using the boot-partition method, which is the core focus of the PR.
Description check ✅ Passed The description fully completes the provided template with all required sections filled: proposed change details the improvements, type of change is checked appropriately (existing features and clarity improvements), checklist items are marked, and additional information includes relevant links.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 4

🧹 Nitpick comments (3)
docs/operating-system/debugging.md (3)

168-168: ⚡ Quick win

Use descriptive link text instead of "here".

Links with "here" as anchor text reduce accessibility and scannability. Use descriptive text that indicates the destination.

♻️ Proposed improvements
 ### Windows
-Windows instructions on how to generate and use private/public keys with Putty are found [here][windows-keys].
+Instructions for generating and using SSH keys with PuTTY on Windows are found in [this guide][windows-keys].
 Instead of the droplet instructions, add the public key as per above instructions.

 ### Linux, WSL, etc.
-Alternative instructions for Mac, Windows and Linux can be found [here](https://docs.github.com/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
+Alternative instructions for Mac, Windows and Linux can be found in [GitHub's SSH key generation guide](https://docs.github.com/authentication/connecting-to-github-with-ssh/generating-a-new-ssh-key-and-adding-it-to-the-ssh-agent).
 Follow the steps under *Generating a new SSH key* (the other sections are not applicable to Home Assistant and can be ignored).

Also applies to: 172-172

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 168, Replace the non-descriptive
"here" anchor text in the sentence "Windows instructions on how to generate and
use private/public keys with Putty are found [here][windows-keys]." with a
descriptive link label such as "Windows PuTTY key generation and usage guide"
(or similar) and update the corresponding reference [windows-keys] usage at the
other occurrence (line 172) so both anchors use the new descriptive text while
keeping the same link target.

37-38: ⚡ Quick win

Clarify the encoding requirement.

The statement "must only contain ASCII characters" and "must be ASCII-encoded (not UTF-8...)" is slightly redundant and potentially confusing, since ASCII is a 7-bit encoding and pure ASCII is a subset of UTF-8. The real concern appears to be avoiding extended character sets and ensuring compatibility with the dropbear SSH server.

♻️ Suggested clarification
-- `authorized_keys` must only contain ASCII characters
-- `authorized_keys` must be ASCII-encoded (not `UTF-8`, not Windows `ISO_8859-1`).
+- `authorized_keys` must contain only 7-bit ASCII characters (no extended Unicode or special characters)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` around lines 37 - 38, The two lines about
authorized_keys are redundant and misleading; update the text so it clearly
states that authorized_keys must contain only US-ASCII characters (bytes
0x00–0x7F) and that the file must be saved with an encoding that does not
introduce non-ASCII bytes (e.g., ASCII or UTF-8 containing only ASCII bytes),
and call out that this restriction ensures compatibility with the dropbear SSH
server; modify the phrasing around "authorized_keys" in the doc to replace the
two current bullets with a single clarified sentence referencing
"authorized_keys" and "dropbear" so readers understand to avoid extended/locale
encodings like ISO_8859-1 or multibyte characters.

195-195: 💤 Low value

Simplify the command to avoid unnecessary pipe.

The cat ... | tee -a pattern can be simplified to just tee -a < file, though the current form is functionally correct.

♻️ Optional simplification
-cat ${SSH_FILE}.pub | tee -a authorized_keys
+tee -a authorized_keys < ${SSH_FILE}.pub
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 195, Replace the unnecessary use
of cat in the SSH key append command: instead of piping the public key file
through cat into tee, invoke tee with input redirection from ${SSH_FILE}.pub so
the public key is appended to authorized_keys more simply (target the line
containing "cat ${SSH_FILE}.pub | tee -a authorized_keys" and change it to use
tee -a with input redirected from ${SSH_FILE}.pub).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/operating-system/debugging.md`:
- Line 64: Fix the typo in the sentence that currently reads "dependending" in
docs/operating-system/debugging.md: locate the line containing the example mount
paths (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`) and replace
"dependending" with the correct word "depending" so the sentence reads "...at
different locations depending on your system...".
- Line 36: Update the capitalization of "MacOS" to Apple's official "macOS" in
the documentation line referencing authorized_keys; locate the sentence
containing `authorized_keys` and replace "MacOS (CR, `\r`)" with "macOS (CR,
`\r`)" so the casing is correct.
- Line 103: Text at the given line uses "installed addons" but the project
standard is "installed add‑ons"; update the phrase in the sentence "Home
Assistant itself and all installed Docker containers." (the string containing
"installed addons") to use the hyphenated form "installed add‑ons" so it matches
other occurrences like "SSH app … add-on".
- Line 165: Remove the recommendation and link to the in-browser SSH key
generator in the sentence "If you are lazy and do not expose your instance, you
could generate both keys [here]..." and replace it with a secure alternative:
delete the link and the phrase "If you are lazy...", and instead advise using
local, well-vetted tools or platform-specific official guidance for SSH key
generation (e.g., ssh-keygen or OpenSSH clients) with a short warning against
third-party/browser-based key generators; update the sentence to a neutral,
security-first recommendation referencing SSH key generation best practices.

---

Nitpick comments:
In `@docs/operating-system/debugging.md`:
- Line 168: Replace the non-descriptive "here" anchor text in the sentence
"Windows instructions on how to generate and use private/public keys with Putty
are found [here][windows-keys]." with a descriptive link label such as "Windows
PuTTY key generation and usage guide" (or similar) and update the corresponding
reference [windows-keys] usage at the other occurrence (line 172) so both
anchors use the new descriptive text while keeping the same link target.
- Around line 37-38: The two lines about authorized_keys are redundant and
misleading; update the text so it clearly states that authorized_keys must
contain only US-ASCII characters (bytes 0x00–0x7F) and that the file must be
saved with an encoding that does not introduce non-ASCII bytes (e.g., ASCII or
UTF-8 containing only ASCII bytes), and call out that this restriction ensures
compatibility with the dropbear SSH server; modify the phrasing around
"authorized_keys" in the doc to replace the two current bullets with a single
clarified sentence referencing "authorized_keys" and "dropbear" so readers
understand to avoid extended/locale encodings like ISO_8859-1 or multibyte
characters.
- Line 195: Replace the unnecessary use of cat in the SSH key append command:
instead of piping the public key file through cat into tee, invoke tee with
input redirection from ${SSH_FILE}.pub so the public key is appended to
authorized_keys more simply (target the line containing "cat ${SSH_FILE}.pub |
tee -a authorized_keys" and change it to use tee -a with input redirected from
${SSH_FILE}.pub).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 335b90f9-be73-4558-9397-d2dc978ace18

📥 Commits

Reviewing files that changed from the base of the PR and between 68b1404 and 7f3a483.

📒 Files selected for processing (1)
  • docs/operating-system/debugging.md

Comment thread docs/operating-system/debugging.md Outdated
Comment thread docs/operating-system/debugging.md Outdated
Comment thread docs/operating-system/debugging.md Outdated
Comment thread docs/operating-system/debugging.md Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

♻️ Duplicate comments (3)
docs/operating-system/debugging.md (3)

64-64: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix the typo.

"dependending" should be "depending".

📝 Proposed fix
-   - The partition is auto-mounted at different locations dependending on your system (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`). 
+   - The partition is auto-mounted at different locations depending on your system (e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 64, There's a typo in the
sentence containing "dependending" — locate the sentence that reads "The
partition is auto-mounted at different locations dependending on your system
(e.g. `/run/media/USER/hassos-boot` or `/mnt/hassos-boot`)." and replace the
misspelled word "dependending" with "depending" so the sentence reads "...at
different locations depending on your system...".

165-165: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove the recommendation for browser-based key generation.

Recommending a third-party in-browser SSH key generator is a significant security risk, even if the generation happens client-side. This practice should not be endorsed in official developer documentation, as it normalizes poor security hygiene and exposes developers to potential key compromise. The statement "If you are lazy and do not expose your instance" downplays real security risks.

🔒 Proposed fix
 Key filenames are inconsequential, and only identify the correct key.
-If you are lazy and do not expose your instance, you could generate both keys [here](https://inbrowser.app/tools/ssh-key-generator/).
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 165, Remove the sentence
recommending the in-browser SSH key generator and replace it with a brief,
secure alternative: instruct readers to generate SSH keys locally using standard
tools (e.g., ssh-keygen on Linux/macOS, PowerShell's New-SshKey/ssh-keygen on
Windows, or their OS's official GUI key tool) and warn explicitly against using
third-party web-based key generators; update the line that currently reads "If
you are lazy and do not expose your instance, you could generate both keys
[here]..." to a short, security-minded sentence guiding local key generation and
discouraging browser-based generators.

103-103: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Fix "installed addons" → "installed add-ons" terminology.

The documentation uses the hyphenated form "add-on" / "add-ons" elsewhere (e.g., line 8 "SSH app (formerly known as an add-on)"), but line 103 says "installed addons". Change to "installed add-ons" for consistency with Home Assistant's standard terminology.

📝 Proposed fix
-Home Assistant itself and all installed addons run in separate Docker containers.
+Home Assistant itself and all installed add-ons run in separate Docker containers.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 103, Replace the phrase
"installed addons" in the sentence "Home Assistant itself and all installed
addons run in separate Docker containers." with the hyphenated form "installed
add‑ons" so it matches the project's consistent terminology ("add‑on"/"add‑ons")
used elsewhere; update that exact string in the
docs/operating-system/debugging.md content to "Home Assistant itself and all
installed add‑ons run in separate Docker containers." ensuring spelling and
hyphenation are consistent.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Duplicate comments:
In `@docs/operating-system/debugging.md`:
- Line 64: There's a typo in the sentence containing "dependending" — locate the
sentence that reads "The partition is auto-mounted at different locations
dependending on your system (e.g. `/run/media/USER/hassos-boot` or
`/mnt/hassos-boot`)." and replace the misspelled word "dependending" with
"depending" so the sentence reads "...at different locations depending on your
system...".
- Line 165: Remove the sentence recommending the in-browser SSH key generator
and replace it with a brief, secure alternative: instruct readers to generate
SSH keys locally using standard tools (e.g., ssh-keygen on Linux/macOS,
PowerShell's New-SshKey/ssh-keygen on Windows, or their OS's official GUI key
tool) and warn explicitly against using third-party web-based key generators;
update the line that currently reads "If you are lazy and do not expose your
instance, you could generate both keys [here]..." to a short, security-minded
sentence guiding local key generation and discouraging browser-based generators.
- Line 103: Replace the phrase "installed addons" in the sentence "Home
Assistant itself and all installed addons run in separate Docker containers."
with the hyphenated form "installed add‑ons" so it matches the project's
consistent terminology ("add‑on"/"add‑ons") used elsewhere; update that exact
string in the docs/operating-system/debugging.md content to "Home Assistant
itself and all installed add‑ons run in separate Docker containers." ensuring
spelling and hyphenation are consistent.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2b4d294a-8d1f-417c-aa86-2d2670d29635

📥 Commits

Reviewing files that changed from the base of the PR and between 7f3a483 and 088b474.

📒 Files selected for processing (1)
  • docs/operating-system/debugging.md

This commit adds detailed instructions for using the /boot/CONFIG method to setup the SSH server.
It also details an example workflow to setup the debugging SSH session effortlessly.
@loeschzwerg
loeschzwerg marked this pull request as draft June 1, 2026 19:27
@loeschzwerg
loeschzwerg marked this pull request as ready for review June 1, 2026 19:28

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

🧹 Nitpick comments (1)
docs/operating-system/debugging.md (1)

165-165: 💤 Low value

Rephrase "inconsequential" for accuracy.

"Key filenames are inconsequential" is misleading—filenames are important for identifying which key to use. Consider: "Key filenames are not restricted by technical requirements, but should be descriptive to identify the correct key."

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 165, The sentence "Key filenames
are inconsequential" is misleading; update the phrasing to clarify that
filenames aren't technically constrained but should be descriptive—for example
replace that sentence with "Key filenames are not restricted by technical
requirements, but should be descriptive to identify the correct key" (locate the
exact phrase "Key filenames are inconsequential" in the debugging.md content and
swap it for the suggested rewording).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/operating-system/debugging.md`:
- Line 75: Edit the sentence that currently reads "Be aware, that _open & close_
can modify a file, e.g. when Auto-Save is on, which can mess with the encoding":
remove the unnecessary comma after "aware", replace "_open & close_" with
"opening and closing a file", and improve clarity by using "e.g., when Auto-Save
is enabled" and "can corrupt the encoding" (resulting in wording like: "Be aware
that opening and closing a file can modify it (e.g., when Auto-Save is enabled),
which can corrupt the encoding.").
- Around line 200-201: The current steps create/append a local authorized_keys
file in the working directory then copy it to ${MOUNT_PATH}/CONFIG, which can
unintentionally modify or leave a file in CWD; instead write the public key
directly to the target path. Replace the two-step sequence that uses "cat
${SSH_FILE}.pub | tee -a authorized_keys" and "sudo cp authorized_keys
${MOUNT_PATH}/CONFIG" with a single operation that appends/writes directly to
the target (e.g., using ${MOUNT_PATH}/CONFIG/authorized_keys with tee or
redirection and sudo as needed) so no temporary authorized_keys is created in
the current directory.

---

Nitpick comments:
In `@docs/operating-system/debugging.md`:
- Line 165: The sentence "Key filenames are inconsequential" is misleading;
update the phrasing to clarify that filenames aren't technically constrained but
should be descriptive—for example replace that sentence with "Key filenames are
not restricted by technical requirements, but should be descriptive to identify
the correct key" (locate the exact phrase "Key filenames are inconsequential" in
the debugging.md content and swap it for the suggested rewording).
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 47fcc450-ba97-4792-a28a-2054721f1496

📥 Commits

Reviewing files that changed from the base of the PR and between 2ce9b20 and 301a52f.

📒 Files selected for processing (1)
  • docs/operating-system/debugging.md

Comment thread docs/operating-system/debugging.md
Comment thread docs/operating-system/debugging.md
Visual layouts are easier to understand than textual descriptions, if suitable.
Multiple Tip, Info, Warning, Caution boxes reduce the perceived importance of the warning box.
increases source markdown readability (unrendered)

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 2

♻️ Duplicate comments (2)
docs/operating-system/debugging.md (2)

75-75: ⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Tighten grammar for clarity in the warning sentence.

“Be aware, that open & close can modify a file...” is grammatically awkward and less clear than needed for a safety-critical warning. Use “Be aware that opening and closing a file...” phrasing.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 75, Replace the awkward sentence
"Be aware, that _open & close_ can modify a file, e.g. when Auto-Save is on,
which can mess with the encoding" with a clearer grammatical warning: "Be aware
that opening and closing a file can modify it, e.g. when Auto-Save is on, which
can mess with the encoding." Change "_open & close_" to "opening and closing a
file", remove the comma after "Be aware", replace "&" with "and", and use "it"
instead of repeating "a file" for clarity.

170-170: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Remove browser-based SSH key generator recommendation from official guidance.

Even with a “discouraged” label, linking a third-party in-browser key generator in core developer docs weakens the security posture and normalizes risky key handling patterns. Keep the guidance to local, trusted tools (ssh-keygen, PuTTYgen) only.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` at line 170, Remove the inbrowser.app
in-browser SSH key generator recommendation by deleting the list item that
contains "[inbrowser.app](https://inbrowser.app/tools/ssh-key-generator/)" and
replace or reword the sentence to only recommend generating SSH keys with local,
trusted tools such as ssh-keygen or PuTTYgen; ensure no third-party
browser-based key generators are referenced in the SSH key generation section.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/operating-system/debugging.md`:
- Around line 110-115: Split the mixed instructions into two clear subsections:
"Disable via Method 1 (USB drive)" and "Disable via Method 2 (hassos-boot
partition)"; under Method 1, describe using a USB partition named CONFIG (case
sensitive), removing any root-level authorized_keys on that USB, and that
rebooting with CONFIG present but without authorized_keys will remove SSH keys
and disable port 22222; under Method 2, describe deleting
/CONFIG/authorized_keys on the hassos-boot partition only (keeping CONFIG), and
state the reboot behavior for that method separately; ensure you reference the
exact symbols CONFIG, /CONFIG/authorized_keys and hassos-boot in each subsection
so readers cannot confuse the methods.
- Line 38: Update the contradictory guidance about authorized_keys: replace the
current claim that it "must be ASCII-encoded (not UTF-8)" with a clear statement
that the file should be plain-text with UTF-8/ASCII-compatible encoding (ASCII
bytes are valid within UTF-8), contain only ASCII key material, and use LF line
endings; refer explicitly to the authorized_keys filename in the text so readers
know to ensure plain-text UTF-8/ASCII compatibility and LF newlines rather than
forbidding UTF-8 outright.

---

Duplicate comments:
In `@docs/operating-system/debugging.md`:
- Line 75: Replace the awkward sentence "Be aware, that _open & close_ can
modify a file, e.g. when Auto-Save is on, which can mess with the encoding" with
a clearer grammatical warning: "Be aware that opening and closing a file can
modify it, e.g. when Auto-Save is on, which can mess with the encoding." Change
"_open & close_" to "opening and closing a file", remove the comma after "Be
aware", replace "&" with "and", and use "it" instead of repeating "a file" for
clarity.
- Line 170: Remove the inbrowser.app in-browser SSH key generator recommendation
by deleting the list item that contains
"[inbrowser.app](https://inbrowser.app/tools/ssh-key-generator/)" and replace or
reword the sentence to only recommend generating SSH keys with local, trusted
tools such as ssh-keygen or PuTTYgen; ensure no third-party browser-based key
generators are referenced in the SSH key generation section.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f859ebc2-721f-4f69-b471-920a91f3b75e

📥 Commits

Reviewing files that changed from the base of the PR and between 301a52f and fbaaa81.

📒 Files selected for processing (1)
  • docs/operating-system/debugging.md

Comment thread docs/operating-system/debugging.md
Comment on lines +110 to +115
1. Use a USB drive with a partition named `CONFIG` (case sensitive) formatted as FAT, ext4, or NTFS.
Remove any existing `authorized_keys` file from the root of that partition.
Using method 2, delete the file `/CONFIG/authorized_keys` on the partition `hassos-boot`, while keeping `CONFIG`.

1. When the Home Assistant OS device is rebooted with this drive inserted, any existing SSH public keys will be removed and SSH access on port 22222 will be disabled.
2. When the Home Assistant OS device reboots with a present `CONFIG` without `authorized_keys`, any existing SSH public keys will be removed and SSH access on port 22222 will be disabled.

@coderabbitai coderabbitai Bot Jun 1, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Split disable instructions by method to avoid accidental misuse.

This block starts with USB-drive instructions and then immediately injects method-2 (hassos-boot) actions in the same numbered flow. That conflicts with your earlier “do not mix method 1 and 2” warning and makes disable steps easy to apply incorrectly.

Please separate into two explicit subsections (Disable via Method 1 / Disable via Method 2) with isolated reboot behavior per method.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@docs/operating-system/debugging.md` around lines 110 - 115, Split the mixed
instructions into two clear subsections: "Disable via Method 1 (USB drive)" and
"Disable via Method 2 (hassos-boot partition)"; under Method 1, describe using a
USB partition named CONFIG (case sensitive), removing any root-level
authorized_keys on that USB, and that rebooting with CONFIG present but without
authorized_keys will remove SSH keys and disable port 22222; under Method 2,
describe deleting /CONFIG/authorized_keys on the hassos-boot partition only
(keeping CONFIG), and state the reboot behavior for that method separately;
ensure you reference the exact symbols CONFIG, /CONFIG/authorized_keys and
hassos-boot in each subsection so readers cannot confuse the methods.

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So basically what the partition layout below states. Wouldn't it be better to replace it with the layouts then?

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧩 Analysis chain

🏁 Script executed:

Length of output: 91


🏁 Script executed:

Length of output: 91



Here are the results from shell you requested:

Shell block treated as final reply content because the matching action tag was not present.

Here are the results from shell you requested:

Shell block treated as final reply content because the matching action tag was not present.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant