# Accessing Containers via SSH

This guide explains how to connect to your running container from a local
terminal using a reverse SSH tunnel via the MPE proxy. This is an advanced
workflow primarily useful for users who prefer local terminal emulators or
specific IDE integrations (like VS Code Remote SSH).

## Prerequisites

Before proceeding with this setup, you **must** have your persistence layer
configured. This ensures your SSH keys and server configurations survive
container restarts.

**Required Setup:**

1. **Persistent Identity:** Follow the
   [Identity and Access](./identity_access.md) guide to ensure your `.ssh`
   directory is stored in persistent storage.
2. **Automation Engine:** Ensure your `.bashrc` is configured via the
   [Shell Automation](./shell_automation.md) guide so that your `.ssh` symlink
   is restored automatically on boot.

Additionally, you will need:

* **A Local SSH Key Pair:** Generated on your laptop (e.g., via `ssh-keygen`).
* **Proxy Access:** MPE users can take advantage of our proxy server
  (`login1.mpe.mpg.de`). Non-MPE users can use any other equivalent proxy.
  Adjust the instructions below accordingly.

## Setup and Connectivity

### 1. One-Time SSH Server Configuration

You need to set up the container to act as an SSH server. Since you have already
set up persistent storage, we will put these files where they will survive
restarts.

**Generate the host key:**

> [!IMPORTANT]
> This is a **Host Key**, which allows the container to act as an SSH server. It
> is different from your **Identity Key** (described in
> [Identity and Access](./identity_access.md)), which you use to authenticate
> with GitHub or GitLab. You need both for full remote access.

```bash
# Generate the host key for the container's SSH server in your persistent folder
ssh-keygen -t ed25519 -f ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/ssh_host_key -N ""
```

**Configure the SSH Daemon:** Create a file at
`~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/sshd_config` with the
following content:

```text
Port 2222
HostKey ~/.ssh/ssh_host_key
PidFile ~/.ssh/sshd.pid
StrictModes no
AuthorizedKeysFile ~/.ssh/authorized_keys
```

*Note: `StrictModes no` is required because the `.ssh` directory is a symlink.*

**Add your Laptop's Public Key:** Paste your laptop's public key (e.g., from
`~/.ssh/id_ed25519.pub` on your local machine) into the `authorized_keys` file
inside your persistent `.ssh` folder:

```bash
# Ensure correct permissions
chmod 600 ~/workspace/Storage/$SCISERVER_USER_NAME/persistent/.ssh/authorized_keys
```

### 2. Activating SSH in a New Container

Once the one-time setup is done and your `.bashrc` is handling the symlinks, you
only need to run these two steps when you start a new container:

#### Step A: Start the SSH server

```bash
/usr/sbin/sshd -D -e -f ~/.ssh/sshd_config
```

#### Step B: Create the reverse tunnel

In a separate terminal tab, map the container's port to the MPE proxy:

```bash
ssh -N -R 2222:localhost:2222 <MPE_USERNAME>@login1.mpe.mpg.de
```

### 3. Connect from your laptop

Now, use the MPE proxy as a jump host to reach the container:

```bash
ssh -J <MPE_USERNAME>@login1.mpe.mpg.de -p 2222 idies@localhost
```