Converge SSH client keepalives for kai-server fleet-wide via ansible #290

New issue

Open

opened 2026-06-12 05:54:46 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-06-12 05:54:46 +00:00

Owner

SSH sessions from client machines into kai-server drop after ~5 minutes idle. Root cause: no keepalives in the client-side ~/.ssh/config host block, so an idle connection sends zero traffic and a NAT/firewall state table (or sshd idle policy) expires it.

The fix is three lines in the kai-server host block, applied by hand on kais-macbook-pro on 2026-06-11:

Host kai-server <tailnet FQDN from /coilysiren/kai-server/tailnet-fqdn>
    ServerAliveInterval 60
    ServerAliveCountMax 4
    TCPKeepAlive yes

~/.ssh/config is not ansible-managed today - nothing in infrastructure/ansible touches client ssh config (the authorized-keys role only manages server-side authorized_keys). So the fix lives only on the MacBook, and kai-desktop-tower / kai-windows-laptop will each hit the same 5-minute drop until they get the same block.

Ask: converge the keepalive block fleet-wide via ansible, per the authoring-vs-rollout split (the rollout belongs here in infrastructure/ansible). Either a small new role for client ssh config or an addition to kai-config. Notes:

The host block also carries User kai, IdentityFile, and (macOS only) UseKeychain / AddKeysToAgent, so the template needs a platform conditional or macOS-only lines guarded appropriately.
The tailnet FQDN in the Host line is SSM-backed (/coilysiren/kai-server/tailnet-fqdn) - resolve at converge time, never hardcode in the template.
Decide whether ansible owns the whole file or a managed block (blockinfile) so hand-added hosts (router, OrbStack include) survive.
Windows path differs (C:\Users\<user>\.ssh\config) - see kai-windows-env for host specifics.

SSH sessions from client machines into kai-server drop after ~5 minutes idle. Root cause: no keepalives in the client-side `~/.ssh/config` host block, so an idle connection sends zero traffic and a NAT/firewall state table (or sshd idle policy) expires it. The fix is three lines in the `kai-server` host block, applied by hand on kais-macbook-pro on 2026-06-11: ``` Host kai-server <tailnet FQDN from /coilysiren/kai-server/tailnet-fqdn> ServerAliveInterval 60 ServerAliveCountMax 4 TCPKeepAlive yes ``` `~/.ssh/config` is not ansible-managed today - nothing in `infrastructure/ansible` touches client ssh config (the `authorized-keys` role only manages server-side authorized_keys). So the fix lives only on the MacBook, and kai-desktop-tower / kai-windows-laptop will each hit the same 5-minute drop until they get the same block. Ask: converge the keepalive block fleet-wide via ansible, per the authoring-vs-rollout split (the rollout belongs here in infrastructure/ansible). Either a small new role for client ssh config or an addition to `kai-config`. Notes: * The host block also carries `User kai`, `IdentityFile`, and (macOS only) `UseKeychain` / `AddKeysToAgent`, so the template needs a platform conditional or macOS-only lines guarded appropriately. * The tailnet FQDN in the `Host` line is SSM-backed (`/coilysiren/kai-server/tailnet-fqdn`) - resolve at converge time, never hardcode in the template. * Decide whether ansible owns the whole file or a managed block (`blockinfile`) so hand-added hosts (router, OrbStack include) survive. * Windows path differs (`C:\Users\<user>\.ssh\config`) - see kai-windows-env for host specifics.

coilysiren added the

label

2026-06-17 07:06:11 +00:00

coilysiren added

and removed

labels

2026-06-17 08:39:32 +00:00