From c5ef1325ab77c9ef2d60c0632d78fed40a920e49 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Apr 2026 14:30:34 +0000
Subject: [PATCH 01/38] feat: add SSH key generation for callis<->client and
callis<->host pairing
Agent-Logs-Url: https://github.com/pacnpal/callis/sessions/4a470c3f-5186-4816-849d-aa0ae0179751
Co-authored-by: pacnpal <183241239+pacnpal@users.noreply.github.com>
---
api/core.py | 114 ++++++++++++++++++++++
api/routers/hosts.py | 6 +-
api/routers/users.py | 89 ++++++++++++++++-
api/static/app.js | 22 +++++
api/templates/hosts.html | 13 +++
api/templates/partials/generated_key.html | 25 +++++
api/templates/user_detail.html | 22 +++++
7 files changed, 287 insertions(+), 4 deletions(-)
create mode 100644 api/templates/partials/generated_key.html
diff --git a/api/core.py b/api/core.py
index 3315476..0bc8ba9 100644
--- a/api/core.py
+++ b/api/core.py
@@ -16,6 +16,14 @@
from cryptography.fernet import Fernet
from cryptography.hazmat.primitives.kdf.pbkdf2 import PBKDF2HMAC
from cryptography.hazmat.primitives import hashes
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey
+from cryptography.hazmat.primitives.serialization import (
+ Encoding,
+ NoEncryption,
+ PrivateFormat,
+ PublicFormat,
+ load_pem_private_key,
+)
import jwt
from jwt.exceptions import PyJWTError as JWTError
import bcrypt
@@ -487,6 +495,112 @@ def _check_rsa_key_size(key_data: bytes, min_bits: int) -> None:
raise ValueError(f"RSA key is {key_bits} bits, minimum {min_bits} required")
+# ---------------------------------------------------------------------------
+# SSH Keypair Generation
+# ---------------------------------------------------------------------------
+
+def generate_ssh_keypair(comment: str = "") -> tuple[str, str]:
+ """Generate an Ed25519 SSH keypair.
+
+ Returns:
+ (private_key_openssh: str, public_key_openssh: str)
+
+ The private key is in OpenSSH PEM format. The public key is a single
+ authorised-keys line; an optional comment is appended when provided.
+ """
+ private_key = Ed25519PrivateKey.generate()
+ private_key_text = private_key.private_bytes(
+ encoding=Encoding.PEM,
+ format=PrivateFormat.OpenSSH,
+ encryption_algorithm=NoEncryption(),
+ ).decode()
+ public_key_text = private_key.public_key().public_bytes(
+ encoding=Encoding.OpenSSH,
+ format=PublicFormat.OpenSSH,
+ ).decode().rstrip()
+ if comment:
+ public_key_text = f"{public_key_text} {comment}"
+ return private_key_text, public_key_text
+
+
+_DEPLOY_KEY_PATH = "/data/callis_deploy_key"
+
+
+def get_server_deploy_public_key() -> str:
+ """Return Callis's server deploy public key, generating it if needed.
+
+ The keypair is persisted to /data/callis_deploy_key[.pub]. Returns the
+ OpenSSH public key as a single-line string, or an empty string if the key
+ cannot be generated (e.g. /data is not writable in dev without Docker).
+
+ This function performs synchronous file I/O. It is intended to be called
+ at most once per process lifetime (on first access) so the blocking impact
+ is negligible.
+ """
+ priv_path = _DEPLOY_KEY_PATH
+ pub_path = priv_path + ".pub"
+
+ # Fast path: public key file already exists.
+ try:
+ with open(pub_path) as f:
+ return f.read().strip()
+ except FileNotFoundError:
+ pass
+ except OSError as exc:
+ logger.warning("Could not read deploy public key at %s: %s", pub_path, exc)
+ return ""
+
+ # Private key exists but public key file is missing — derive it.
+ try:
+ with open(priv_path, "rb") as f:
+ priv_bytes = f.read()
+ priv = load_pem_private_key(priv_bytes, password=None)
+ pub_text = priv.public_key().public_bytes(
+ encoding=Encoding.OpenSSH,
+ format=PublicFormat.OpenSSH,
+ ).decode().strip()
+ try:
+ with open(pub_path, "w") as f:
+ f.write(pub_text + "\n")
+ except OSError:
+ pass
+ return pub_text
+ except FileNotFoundError:
+ pass
+ except Exception as exc:
+ logger.warning("Could not load existing deploy private key at %s: %s", priv_path, exc)
+
+ # Generate a fresh keypair and persist it.
+ private_key_text, public_key_text = generate_ssh_keypair(comment="callis@deploy")
+ public_key_text = public_key_text.strip()
+ try:
+ os.makedirs(os.path.dirname(priv_path), exist_ok=True)
+ except (OSError, ValueError) as exc:
+ logger.warning("Could not create directory for deploy key at %s: %s", priv_path, exc)
+ try:
+ fd = os.open(priv_path, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
+ with os.fdopen(fd, "w") as f:
+ f.write(private_key_text)
+ except FileExistsError:
+ # Another concurrent call beat us — recurse once to pick up the new key.
+ return get_server_deploy_public_key()
+ except (PermissionError, OSError) as exc:
+ logger.warning(
+ "Could not persist server deploy key to %s: %s. "
+ "A new key will be generated on next restart.",
+ priv_path,
+ exc,
+ )
+ return public_key_text
+ try:
+ with open(pub_path, "w") as f:
+ f.write(public_key_text + "\n")
+ except (PermissionError, OSError) as exc:
+ logger.warning("Could not write deploy public key to %s: %s", pub_path, exc)
+ logger.info("Generated Callis server deploy key and saved to %s", priv_path)
+ return public_key_text
+
+
# ---------------------------------------------------------------------------
# Audit logging (append-only)
# ---------------------------------------------------------------------------
diff --git a/api/routers/hosts.py b/api/routers/hosts.py
index 38e7383..d86f232 100644
--- a/api/routers/hosts.py
+++ b/api/routers/hosts.py
@@ -8,7 +8,7 @@
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy.orm import selectinload
-from core import get_db, get_runtime_setting, get_settings, register_template_filters, slugify, write_audit_log
+from core import get_db, get_runtime_setting, get_settings, get_server_deploy_public_key, register_template_filters, slugify, write_audit_log
from dependencies import require_role, require_totp_complete
from models import AuditAction, Host, User, UserRole
@@ -44,7 +44,7 @@ async def host_list(
return templates.TemplateResponse(
request,
"hosts.html",
- context={"hosts": hosts, "user": user, "settings": settings, "ssh_host": ssh_host, "all_users": all_users},
+ context={"hosts": hosts, "user": user, "settings": settings, "ssh_host": ssh_host, "all_users": all_users, "server_deploy_key": get_server_deploy_public_key()},
)
@@ -72,7 +72,7 @@ async def _form_error(detail: str):
return templates.TemplateResponse(
request,
"hosts.html",
- context={"error": detail, "hosts": all_hosts, "user": user, "settings": settings, "ssh_host": ssh_host, "all_users": au},
+ context={"error": detail, "hosts": all_hosts, "user": user, "settings": settings, "ssh_host": ssh_host, "all_users": au, "server_deploy_key": get_server_deploy_public_key()},
status_code=400,
)
diff --git a/api/routers/users.py b/api/routers/users.py
index 0c7af8d..2ddde32 100644
--- a/api/routers/users.py
+++ b/api/routers/users.py
@@ -1,4 +1,5 @@
from urllib.parse import urlparse
+from datetime import datetime, timezone
from fastapi import APIRouter, Depends, Form, HTTPException, Request
from fastapi.responses import HTMLResponse, RedirectResponse
@@ -7,7 +8,7 @@
from sqlalchemy.ext.asyncio import AsyncSession
from sqlalchemy.orm import selectinload
-from core import RESERVED_USERNAMES, USERNAME_RE, get_db, get_runtime_setting, get_settings, hash_password, parse_ssh_public_key, register_template_filters, write_audit_log
+from core import RESERVED_USERNAMES, USERNAME_RE, generate_ssh_keypair, get_db, get_runtime_setting, get_settings, hash_password, parse_ssh_public_key, register_template_filters, write_audit_log
from dependencies import require_admin_or_self, require_role
from models import AuditAction, SSHKey, User, UserRole
@@ -391,3 +392,89 @@ async def revoke_key(
context={"keys": keys, "target_user_id": user_id, "user": user},
)
return RedirectResponse(url=request.url_for("user_detail", user_id=user_id), status_code=303)
+
+
+@router.post("/users/{user_id}/keys/generate")
+async def generate_key(
+ request: Request,
+ user_id: str,
+ label: str = Form(""),
+ db: AsyncSession = Depends(get_db),
+ user: User = Depends(require_admin_or_self),
+):
+ # Verify target user exists and is active
+ target_result = await db.execute(select(User).where(User.id == user_id))
+ target = target_result.scalar_one_or_none()
+ if not target:
+ raise HTTPException(status_code=404, detail="User not found")
+ if not target.is_active:
+ raise HTTPException(status_code=400, detail="Cannot generate keys for inactive user")
+
+ # Check key limit
+ max_keys = await get_runtime_setting("max_keys_per_user")
+ count_result = await db.execute(
+ select(func.count()).where(SSHKey.user_id == user_id, SSHKey.is_active == True)
+ )
+ current_count = count_result.scalar()
+ if current_count >= max_keys:
+ raise HTTPException(
+ status_code=400,
+ detail=f"Maximum {max_keys} keys per user",
+ )
+
+ # Default label when blank
+ label = label.strip()
+ if not label:
+ label = f"Generated {datetime.now(timezone.utc).strftime('%Y-%m-%d %H:%M')}"
+
+ # Generate Ed25519 keypair; use username as the key comment
+ private_key_text, public_key_text = generate_ssh_keypair(comment=target.username)
+
+ try:
+ key_info = parse_ssh_public_key(public_key_text)
+ except ValueError as e:
+ raise HTTPException(status_code=500, detail=f"Key generation error: {e}")
+
+ new_key = SSHKey(
+ user_id=user_id,
+ label=label,
+ public_key_text=key_info["public_key_text"],
+ fingerprint=key_info["fingerprint"],
+ key_type=key_info["key_type"],
+ )
+ db.add(new_key)
+ await db.flush()
+
+ await write_audit_log(
+ db,
+ actor_id=user.id,
+ action=AuditAction.KEY_ADDED,
+ target_type="key",
+ target_id=new_key.id,
+ source_ip=request.client.host if request.client else None,
+ detail={
+ "fingerprint": key_info["fingerprint"],
+ "key_type": key_info["key_type"],
+ "label": label,
+ "generated": True,
+ },
+ )
+
+ # Fetch updated key list for the out-of-band swap
+ keys_result = await db.execute(
+ select(SSHKey).where(SSHKey.user_id == user_id, SSHKey.is_active == True)
+ )
+ keys = keys_result.scalars().all()
+
+ return templates.TemplateResponse(
+ request,
+ "partials/generated_key.html",
+ context={
+ "private_key": private_key_text,
+ "label": label,
+ "fingerprint": key_info["fingerprint"],
+ "keys": keys,
+ "target_user_id": user_id,
+ "user": user,
+ },
+ )
diff --git a/api/static/app.js b/api/static/app.js
index ebcc878..38b2e5f 100644
--- a/api/static/app.js
+++ b/api/static/app.js
@@ -115,3 +115,25 @@ document.addEventListener("change", function (e) {
}
}
});
+
+// Download private key: reads the key from the element referenced by
+// data-key-source (a data-copy-target id) and triggers a browser download
+// using the filename in data-download-key.
+document.addEventListener("click", function (e) {
+ var btn = e.target.closest("[data-download-key]");
+ if (!btn) return;
+ var filename = btn.getAttribute("data-download-key") || "id_ed25519";
+ var sourceId = btn.getAttribute("data-key-source") || "generated-private-key";
+ var copyTarget = document.querySelector('[data-copy-target="' + sourceId + '"]');
+ if (!copyTarget) return;
+ var text = copyTarget.textContent;
+ var blob = new Blob([text], { type: "text/plain" });
+ var url = URL.createObjectURL(blob);
+ var a = document.createElement("a");
+ a.href = url;
+ a.download = filename;
+ document.body.appendChild(a);
+ a.click();
+ document.body.removeChild(a);
+ URL.revokeObjectURL(url);
+});
diff --git a/api/templates/hosts.html b/api/templates/hosts.html
index 5f8fad3..b4c8793 100644
--- a/api/templates/hosts.html
+++ b/api/templates/hosts.html
@@ -127,4 +127,17 @@
Add Host
{% if not hosts %}
No hosts configured yet. {% if user.role.value == "admin" %}Click Add Host above to register your first internal server. Once added, assign users so they can connect through the bastion.{% else %}Ask an administrator to add hosts and assign you to them.{% endif %}
{% endif %}
+
+{% if user.role.value == "admin" and server_deploy_key %}
+
+
+
Callis Server Key
+
+
Add this public key to each target host's ~/.ssh/authorized_keys (or the relevant system user's authorized_keys) to allow Callis to authenticate when connecting directly to that host. This key is unique to this Callis instance.
+
+
+
+
{{ server_deploy_key }}
+
On each target host run: echo '{{ server_deploy_key }}' >> ~/.ssh/authorized_keys
+ Save this file as ~/.ssh/id_ed25519 (or a name of your choice) and set its permissions:
+ chmod 600 ~/.ssh/id_ed25519.
+ Update your SSH config's IdentityFile to point to the file you saved.
+