hailin
/
it0
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

refactor: clean up agent SSH setup after fixing host-local routing 

- Remove iproute2/NET_ADMIN (no longer needed)
- Remove ip route hack from entrypoint.sh
- rwa-colocation-2 server record updated to use Docker gateway IP
  since 14.215.128.96 is a host-local NIC on the IT0 server

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
hailin 2026-02-26 18:11:44 -08:00
parent 836d4d2a03
commit 3ed20cdf08
3 changed files with 1 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
Dockerfile.service
View File

@ -40,7 +40,7 @@ RUN pnpm turbo build --filter='./packages/shared/*' --filter=@it0/${SERVICE_NAME
FROM node:18-alpine FROM node:18-alpine
# Install bash (required by Claude Agent SDK Bash tool) + openssh-client (for SSH to managed servers) + su-exec (for privilege drop) # Install bash (required by Claude Agent SDK Bash tool) + openssh-client (for SSH to managed servers) + su-exec (for privilege drop)
RUN apk add --no-cache bash openssh-client su-exec iproute2 RUN apk add --no-cache bash openssh-client su-exec
RUN corepack enable RUN corepack enable

2
deploy/docker/docker-compose.yml
View File

@ -116,8 +116,6 @@ services:
SERVICE_PORT: 3002 SERVICE_PORT: 3002
container_name: it0-agent-service container_name: it0-agent-service
restart: unless-stopped restart: unless-stopped
cap_add:
- NET_ADMIN
ports: ports:
- "13002:3002" - "13002:3002"
volumes: volumes:

7
entrypoint.sh
View File

@ -6,12 +6,5 @@ if [ -f /tmp/host-ssh-key ]; then
chown appuser:appuser /home/appuser/.ssh/id_ed25519 chown appuser:appuser /home/appuser/.ssh/id_ed25519
fi fi
# Route host-local IPs through Docker gateway (for IPs bound to host NICs)
# 14.215.128.96 is on the host's enp5s0 NIC, unreachable via default Docker NAT
GATEWAY=$(ip route | awk '/default/ {print $3}')
if [ -n "$GATEWAY" ]; then
ip route add 14.215.128.96/32 via "$GATEWAY" 2>/dev/null || true
fi
# Drop privileges and start the service # Drop privileges and start the service
exec su-exec appuser node dist/services/${SERVICE_NAME}/src/main exec su-exec appuser node dist/services/${SERVICE_NAME}/src/main