feat: crew SSH-mesh (DRAFT, stacked on #129)#137
Closed
zozo123 wants to merge 2 commits into
Closed
Conversation
Add a reserved label `crew=<name>` and a `--crew` flag on `run` / `warmup`. `list`, `status`, `release` accept `--crew` as a selector. For Tailscale-capable providers, the CLI mints the auth key tagged `tag:cbx-crew-<owner>-<name>` in user context — broker never sees Tailscale credentials. Cloud-init writes `/etc/hosts.cbx` so peers are reachable as `<slug>.cbx` and `<role>.cbx`. The `.cbx` suffix avoids collision with the real `.box` ICANN gTLD. When `TS_API_KEY` is exported, the CLI also self-bootstraps the concrete `tag:cbx-crew-*` rows on the operator tailnet on the first lease in each new crew — GET the policy with ETag, merge the missing tagOwners and self-peering grant, PUT back with If-Match so concurrent edits fail fast. Doctor reports `auto-managed` in that mode and falls back to a manual snippet hint without the key. Non-Tailscale providers honor `--crew` as metadata; networking is rejected with a clear message and surfaced by doctor.
Adds `crabbox crew connect <name>` and `--expose <port>` on run/warmup. The connect command opens local SSH `-L` tunnels from the operator machine to each crew member's exposed port, so the operator can dial peers by name at `127.0.0.1:<port>`. No daemon on the lease, no relay, no SaaS — just SSH, which every crabbox SSH-lease provider already gives us. Open source by construction; works on AWS / Azure / GCP / Hetzner / Proxmox / exe.dev / RunPod / Sprites / Namespace / Semaphore / Daytona. Lease-to-lease peer dial (true P2P mesh) is a future follow-up. Stacked on openclaw#129 — merge after the crew foundation lands.
This was referenced May 21, 2026
Contributor
Author
|
Closing in favor of #129, which now consolidates all three transport planes. The SSH-mesh work ( |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
TL;DR
Operator-orchestrated SSH-mesh:
crabbox crew connect <name>opens local SSH-Ltunnels from the operator's machine to each crew member's--expose'd port. Peers reachable by name at127.0.0.1:<port>for the operator's shell. Works on every SSH-accessible provider. No Tailscale, no Headscale, no relay, no SaaS — just SSH.How it works
--expose <port>onrun/warmup: declares the lease wants this port reachable. Repeatable; multi-valued. Written into a reserved provider label.crabbox crew connect <name>: reads crew members, opensssh -Lper (member, port), writes~/.crabbox/crew/<name>/{hosts,env}, holds connections open with SSH ControlMaster reuse.--exportprints shell exports;--jsondumps the forward table.crabbox doctor --crew <name>: reports the SSH-mesh plane alongside the Tailscale plane (crew-meshsub-check).What this is NOT
-Lis TCP-only.Tested
--exposeparsing, label rendering, hosts/env file rendering, doctor counts,ssh -Larg construction, and full launch + teardown over a recording runner.go test -race ./internal/cli/...clean.Open questions
--expose <port>vs--mesh-port <port>vs--reachable <port>?crew connectdaemonize or stay foreground (current: foreground)?Related