75f2945f66
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: mhoennig <michael@hoennig.de> Reviewed-on: #28
2.0 KiB
WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR-documentation is not maintained along with new PRs — treat it as a snapshot, not as current documentation.
The Problem
tools/remote instance-update opens about ten SSH and SCP connections in a few seconds: the access check, the upload with its checksum verification, the service stop, the unpacking, the start.
On 2026-09-08 the mih09 host answered the third and later connections with Connection refused while the first had worked, twice in a row — a connection-rate limit in the Hostsharing firewall, which a Managed Server customer cannot change.
The script then aborts halfway, which is safe (it uploads before it stops anything) but leaves the deploy undone until a retry that may hit the same limit.
Non-Goals
- Changing anything on the host or asking Hostsharing to lift the limit: the limit is theirs, the connection storm is ours.
- A change in what the script does; only how many connections it uses.
The Solution
tools/remote wraps ssh and scp in shell functions that add OpenSSH connection multiplexing: ControlMaster=auto with a control socket under $XDG_RUNTIME_DIR (falling back to $TMPDIR, then /tmp), named by the %C hash of user, host and port, and ControlPersist=10m.
The first call of a run opens the master, every later ssh/scp of that run — and of any run within the next ten minutes — travels through it, so one deploy is one TCP connection.
The functions shadow the commands only inside the script; ssh-copy-id, which the first-contact path calls, keeps using its own ssh.
The port-forward command still works: its ssh -N -L becomes a client of the master, and stop kills that client as before.
Verified with an instance-update on mih09 through wrappers with the same options (the deploy of PR #27), before the change was moved into the script.
Additional Changes
docs/deployment.mdmentions the multiplexing in thetools/remoteoverview.