Date: 2026-02-09
Node: drg-k8s.auth.home.lan (192.168.1.9)
git pull for AutoCoder-Engine failed from drg-k8s due to:
gitea-private.app.lan resolving to 192.168.1.4 (kryptovisor) where :222 did not present an SSH banner (SSH forwarder / routing issue).git user's home directory (/data/git) was group-writable (2770), which violates OpenSSH strict mode checks./data/git/.ssh/authorized_keys inside the Gitea pod (keys existed in Gitea DB, but the file was not generated).Added an /etc/hosts entry on drg-k8s:
gitea-private.app.lan -> 192.168.1.9Purpose: bypass the non-responsive 192.168.1.4:222 path for Git-over-SSH from this node.
Backup created:
/home/ax_julian/temp/hosts.bak.20260209T1649Zauthorized_keys in the Gitea podIn pod/gitea (namespace gitea), executed as user git:
gitea admin regenerate keysResult:
/data/git/.ssh/authorized_keys created and populated with command-restricted keys (gitea serv key-* entries)./data/git (hostPath)Changed /data/git mode:
2770 (drwxrws---)0750 (drwxr-x---)Reason: OpenSSH refused pubkey auth with Authentication refused: bad ownership or modes for directory /data/git.
From drg-k8s:
ssh -p 222 git@gitea-private.app.lan authenticates (Gitea prints the expected "no shell access" message).git -C /home/ax_julian/AutoCoder-Engine pull --ff-only succeeds./etc/hosts override line for gitea-private.app.lan (and restore from backup if desired)./data/git mode back to previous (not recommended for OpenSSH strict modes).gitea-private.app.lan SSH (:222) works without per-node /etc/hosts overrides (either repair the kryptovisor SSH forwarder or update DNS to point at 192.168.1.9 as appropriate)./data/git non-group-writable if OpenSSH strict modes remain enabled.