# SSH mesh — passwordless access

All ATC lab VMs share a cluster SSH key so root can hop between hosts without passwords.

## Design

| Item | Path / value |
|------|----------------|
| Shared private key | `/root/.ssh/atc_cluster` (on each VM, **not** in git) |
| Shared public key | `/root/.ssh/atc_cluster.pub` |
| SSH client snippet | `/root/.ssh/config.d/99-atc-lab.conf` |
| Host aliases | `/etc/hosts` block tagged `ATC Lakehouse lab` |

Proxmox (`pve01`) also keeps its admin key in each VM's `authorized_keys` for break-glass access.

## Fleet (mesh enabled)

| Hostname | IP |
|----------|-----|
| atc-docker01 | 10.0.21.45 |
| atc-docker02 | 10.0.21.47 |
| atc-mgt01 | 10.0.20.104 |
| atc-kafka01 | 10.0.21.36 |
| atc-lake01 | 10.0.21.50 |
| atc-elastic01 | 10.0.21.46 |
| atc-db01 | 10.0.20.112 |
| atc-db02 | 10.0.21.51 |
| atc-grafana | 10.0.20.103 |
| atc-airflow01 | 10.0.21.55 |
| atc-portal01 | 10.0.21.49 |
| atc-lama01 | 10.0.21.39 |

## Deploy / refresh

From Proxmox (or any host with root SSH to the fleet):

```bash
cd /root/lakehouse
./scripts/setup/setup-ssh-mesh.sh
```

## Test

```bash
ssh -i ~/.ssh/atc_cluster root@atc-docker01
ssh -i ~/.ssh/atc_cluster root@atc-lake01 hostname
# or from docker01:
for h in atc-db01 atc-kafka01 atc-mgt01; do
  ssh -i /root/.ssh/atc_cluster root@$h hostname -f
done
```

## Hosts not yet in the mesh

These VMs did not accept the hypervisor key (different credentials or SSH policy):

- `10.0.21.52`, `10.0.21.37`, `10.0.21.38`, `10.0.21.41`
- `10.0.20.111` (ObjectScale), `10.0.20.31`, `10.0.21.44`

Add the cluster public key manually after fixing root access:

```bash
cat /root/.ssh/atc_cluster.pub   # from any mesh host
# paste into target:/root/.ssh/authorized_keys
```

## Security note

The cluster private key is powerful. Restrict Forgejo repo access and rotate keys if the lab is exposed outside your network.