75f2945f66
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: mhoennig <michael@hoennig.de> Reviewed-on: #28
28 lines
2.0 KiB
Markdown
28 lines
2.0 KiB
Markdown
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR-documentation is not maintained along with new PRs — treat it as a snapshot, not as current documentation.
|
|
|
|
## The Problem
|
|
|
|
`tools/remote instance-update` opens about ten SSH and SCP connections in a few seconds: the access check, the upload with its checksum verification, the service stop, the unpacking, the start.
|
|
On 2026-09-08 the mih09 host answered the third and later connections with `Connection refused` while the first had worked, twice in a row — a connection-rate limit in the Hostsharing firewall, which a Managed Server customer cannot change.
|
|
The script then aborts halfway, which is safe (it uploads before it stops anything) but leaves the deploy undone until a retry that may hit the same limit.
|
|
|
|
## Non-Goals
|
|
|
|
- Changing anything on the host or asking Hostsharing to lift the limit: the limit is theirs, the connection storm is ours.
|
|
- A change in what the script does; only how many connections it uses.
|
|
|
|
## The Solution
|
|
|
|
`tools/remote` wraps `ssh` and `scp` in shell functions that add OpenSSH connection multiplexing: `ControlMaster=auto` with a control socket under `$XDG_RUNTIME_DIR` (falling back to `$TMPDIR`, then `/tmp`), named by the `%C` hash of user, host and port, and `ControlPersist=10m`.
|
|
The first call of a run opens the master, every later ssh/scp of that run — and of any run within the next ten minutes — travels through it, so one deploy is one TCP connection.
|
|
The functions shadow the commands only inside the script; `ssh-copy-id`, which the first-contact path calls, keeps using its own ssh.
|
|
The port-forward command still works: its `ssh -N -L` becomes a client of the master, and `stop` kills that client as before.
|
|
|
|
Verified with an `instance-update` on mih09 through wrappers with the same options (the deploy of PR #27), before the change was moved into the script.
|
|
|
|
## Additional Changes
|
|
|
|
- `docs/deployment.md` mentions the multiplexing in the `tools/remote` overview.
|