Skip to content

Inbound SSH to Whrrr VMM guests: humans and agents

ubuncap (192.168.6.100) and recordurbate (192.168.6.98) are Ansible-managed VMM guests on Synology whrrr. User someone, NOPASSWD sudo.

Related: saltierpoop-inbound-ssh-agents.md, ssh-keys-and-infra-services.md.

Three access paths

Who Command Key Notes
You (interactive) ssh someone@192.168.6.100 (or .98) Personal / 1Password May prompt for passphrase
Cursor / agents (direct) ssh ubuncap-cursor / ssh recordurbate-cursor ~/.ssh/cursor-infra Same key as infra-services-cursor
C&C from infra-services sudo ssh -i /etc/homelab/patch-controller/id_ed25519 someone@… patch-controller Restricted to from="192.168.6.17" on server

Patch-controller keys are installed by coordinated patching bootstrap / site.yml. They only work from infra-services, not from your laptop.

Workstation SSH config

On your PC (not infra-services): edit %USERPROFILE%\.ssh\config — the same file that already defines infra-services-cursor. Add these blocks there (WSL only if you SSH from WSL; Cursor’s default terminal on Windows uses the Windows config):

Host ubuncap-cursor
    HostName 192.168.6.100
    User someone
    IdentityFile ~/.ssh/cursor-infra
    IdentitiesOnly yes
    IdentityAgent none

Host recordurbate-cursor
    HostName 192.168.6.98
    User someone
    IdentityFile ~/.ssh/cursor-infra
    IdentitiesOnly yes
    IdentityAgent none

# Synology DSM (whrrr) — not an operator-shell target; agent access only.
Host whrrr-cursor
    HostName 192.168.6.215
    Port 65222
    User someone
    IdentityFile ~/.ssh/cursor-infra
    IdentitiesOnly yes
    IdentityAgent none

If DSM rejects someone, try User admin (or your DSM admin account) in a local override — do not commit DSM usernames that differ from inventory.

Synology DSM (whrrr) agent SSH

DSM listens on TCP 65222 (192.168.6.215). Operator-shell / zsh rollout does not apply to DSM; this alias is for ops access only.

  1. Add the whrrr-cursor block above to your Windows ~\.ssh\config.
  2. Authorize cursor-infra.pub on the DSM account (Control Panel → Terminal & SNMP → enable SSH, then append the pubkey to that user's ~/.ssh/authorized_keys, or use DSM UI equivalent).
  3. Verify:
ssh -o BatchMode=yes whrrr-cursor 'hostname'

Personal id_rsa_whrrr / 1Password agent paths remain for interactive human login; Cursor should use whrrr-cursor + IdentityAgent none so the file key wins.

Authorize the agent key (one-time)

The cursor-infra public key must be in /home/someone/.ssh/authorized_keys.

Option A — from infra-services (patch-controller already trusted):

# ubuncap
type %USERPROFILE%\.ssh\cursor-infra.pub | ssh infra-services-cursor \
  "sudo ssh -i /etc/homelab/patch-controller/id_ed25519 someone@192.168.6.100 \
   'mkdir -p .ssh && chmod 700 .ssh && cat >> .ssh/authorized_keys && chmod 600 .ssh/authorized_keys'"

# recordurbate
type %USERPROFILE%\.ssh\cursor-infra.pub | ssh infra-services-cursor \
  "sudo ssh -i /etc/homelab/patch-controller/id_ed25519 someone@192.168.6.98 \
   'mkdir -p .ssh && chmod 700 .ssh && cat >> .ssh/authorized_keys && chmod 600 .ssh/authorized_keys'"

Option B — while logged in as you on each VM:

echo 'PASTE_cursor-infra.pub_ONE_LINE' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

Do not commit the pubkey to git.

Verification

# Where Command Expect
1 Cursor terminal (Windows PowerShell — same as infra-services-cursor) ssh -o BatchMode=yes ubuncap-cursor 'echo ok' ok
2 Cursor terminal ssh -o BatchMode=yes recordurbate-cursor 'echo ok' ok
3 Cursor terminal ssh -o BatchMode=yes whrrr-cursor 'hostname' DSM hostname (after pubkey authorized)
4 infra-services sudo ssh -i /etc/homelab/patch-controller/id_ed25519 someone@192.168.6.100 hostname ubuncap