Generating your SSH key¶
Everyone who administers a host generates their own key, on their own machine. Two minutes, once.
The inventory moved, 16 October 2026
The live inventory is now its own private repository, octopodia-abos-inventory, cloned beside the code
(ADR-0042). Paths below written as
infra/inventory/... or inventory/... are now in that repository, and secrets no longer go in
group_vars/all/vault.yml: a host's go in host_vars/<host>/vault.yml (vault ID core), a tenant's in
tenants/<slug>/vault.yml (the tenant's own vault ID), each value added with ansible-vault encrypt_string.
See the inventory repository runbook.
Never send anyone your private key
You will end up with two files. One is safe to share, one is never shared with anyone, including your business partner.
| File | What it is | Share it? |
|---|---|---|
id_ed25519.pub |
Public key. Starts with ssh-ed25519 |
Yes, this is the one to send |
id_ed25519 |
Private key. Starts with -----BEGIN |
Never. Not by email, Teams, or USB |
If someone sends you a key that does not start with ssh-, they have sent the private one. Ask them to generate a fresh pair, and treat the old one as compromised.
Generate it¶
Windows (PowerShell, Git Bash or WSL all work), macOS, or Linux:
| Prompt | What to do |
|---|---|
| File to save the key | Press Enter to accept the default |
| Passphrase | Set one. It encrypts the private key on disk, so a stolen laptop is not instant access |
| Confirm passphrase | Type it again |
The comment after -C is only a label. Use something that identifies the machine, such as el@laptop or lachlan@desktop, so a key can be identified and removed later if that machine is lost.
The fingerprint and randomart it prints are not the key. Ignore them.
Send the public key¶
That prints one long line. Copy the whole thing, including the ssh-ed25519 at the start and the comment at the end:
Send that. Public keys are not secret, so any channel is fine. They are committed to git.
Where it ends up¶
Added to infra/inventory/group_vars/all/main.yml:
admin_users:
- name: el
key: "ssh-ed25519 AAAA... el@laptop"
- name: lachlan
key: "ssh-ed25519 AAAA... lachlan@laptop"
The hardening role creates a user account per person and installs their key. From then on you reach the host over Tailscale, because there is no public SSH port (ADR-0031):
You will need to be on the tailnet. Ask El for an invite if you are not already.
Why one key per person¶
Per ADR-0021 §4, private keys are never shared between people:
- Revocation. A shared key cannot be removed for one person without locking out both.
- Attribution. Logs show which account acted. With a shared key, that is unknowable.
One key per person, and realistically one admin machine per person. If you do add a second machine, generate a separate key for it and name the comment distinctly, rather than copying the private key across. Copying it means transporting it somewhere, and that is the moment it stops being private.
If you lose the private key¶
You lose SSH access, but not the server. The Vultr web console is a browser-based terminal into the VM and depends on neither SSH nor Tailscale. Log in there, add a new public key, and carry on.
Find that console before you need it. See host setup §1.