Repository navigation
feat(backend): pin SSH host keys and DSM's self-signed certificate - #147
Merged
Merged
Conversation
SSH (Mac mini, Raspberry Pi direct and legacy relay) accepted any host
key, so a machine taking over the host's address received Watchman's
login. New optional fields sshHostKey / macMiniSshHostKey take the
fingerprint ssh-keygen -lf prints ("SHA256:..."). When set, the pool and
the one-shot executor verify the key during the handshake, before any
credentials are sent, and a mismatch is UNAUTHORIZED naming both
fingerprints. Changing the pin opens a new pooled connection. Empty
keeps today's behaviour.
Synology DSM over https:// with DSM's default self-signed certificate
failed with a bare "http request failed". New optional dsmCertSha256
routes DSM requests through the existing pinned client (checked in the
TLS handshake, before the DSM password is sent). Without a pin, an
untrusted-certificate failure now says to set the fingerprint.
Config validation rejects malformed fingerprints. Docs: macmini,
raspberry-pi, synology.
Coverage Report
File CoverageNo changed files found. |
Coverage Report for backend
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
EraPartner
marked this pull request as ready for review
October 28, 2026 09:53
EraPartner
enabled auto-merge (squash)
October 28, 2026 09:53
EraPartner
disabled auto-merge
October 28, 2026 11:44
EraPartner
added a commit
that referenced
this pull request
Oct 28, 2026
…144) * docs: add per-service setup guides with least-privilege credentials Add docs/guides/service-setup/ with an index and one guide for each of the 13 service kinds: what to enable on the service, which read-only or least-privilege credentials to create, what to enter in Watchman, and troubleshooting keyed to the error messages in the code. Link the guides from the integration pages and indexes, and fix doc drift found while checking against the code: AdGuard no longer claims toggle control, the Homebridge health probe path, Bitcoin's Tor claim, and the unused zmqRawtxEndpoint. * docs: drop Test connection caveat, fix useServiceHealth hook doc #146 made Test connection report an unreachable service as Failed, so the setup guides no longer need the known-issue callout. docs/components/use-service-health.md described a protection-toggle mutation hook and a cache-clear hook that don't exist; rewrite it from apps/frontend/src/hooks/useServiceHealth.ts (read-only, ADR-032). * docs: update setup guides for the service bug fixes on main Rebased onto #145/#147/#148: document SSH host-key pinning (Mac Mini, Pi), the DSM certificate fingerprint and DSM-only health, the now-used Bitcoin rawtx ZMQ endpoint, Roon pairing state in DATA_DIR, and the new error messages and login backoffs. --------- Co-authored-by: Claude <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Requested by EraPartner · project thread
Follow-up to #145. The user approved both items that #145 listed under "Not changed".
Changes
sshHostKey(Mac mini, Pi) andmacMiniSshHostKey(Pi relay) take theSHA256:…fingerprint thatssh-keygen -lfprints. When a fingerprint is set, the pool and the one-shot executor check the host key during the handshake, before any credentials are sent. A mismatch is reported asUNAUTHORIZEDand the message names both fingerprints. Changing the pin opens a new pooled connection. An empty field keeps the current behaviour.https://dsmCertSha256. When it is set, DSM requests go through the existing pinned client (createPinnedClient, the same one Hue uses). The client checks the certificate in the TLS handshake, before the DSM password is sent. Without a pin, an untrusted certificate now gives an error that says to set the fingerprint.Docs:
docs/integrations/{macmini,raspberry-pi,synology}.mdnow include the steps to get each fingerprint.Decisions (standing rule: pick the recommended option)
allowSelfSignedtoggle. A toggle would turn off verification, and anything on the network could then receive the DSM password.ServiceInfragets an injectablepinnedHttpfactory, defaulting tocreatePinnedClient, so the client choice can be tested.Read-only rule
No new calls to monitored services. The PR only adds checks to connections that already exist.
Checks
Nothing ran in the cloud (npm is unreachable), so CI is the first run. Regression tests are in
hostKey.test.ts,sshPool.test.ts,MacMiniService.test.ts,PiStatsCollector.test.ts,dsmClient.test.ts,registerServices.test.tsandfieldMetadata.test.ts.hostKey.tswas run directly with Node 22, and its fingerprint for the test key matched a separate Python computation (sha256, then base64 without padding). The match withssh-keygenoutput was not checked here becausessh-keygenisn't installed in the cloud.🤖 Generated with Claude Code
https://claude.ai/code/session_018QJtaL6RxEK3gXc6YDZdPD