provisionGit returned early when the Forgejo account already existed, so
EnsureKey only ever ran during first provisioning. A member who deleted their
key on git.profullstack.com never got it back: every later BBS login hit the
`if !created { return }` and skipped key registration entirely. The comment on
the web verify path ("key is added on next BBS login") was describing behaviour
that could not happen.
Key registration now runs on every provisionGit call that carries a session
key. EnsureKey was already idempotent — it GETs the account's keys and compares
key material ignoring the comment — so re-running it is free when nothing
changed, and it re-adds a removed key, picks up a rotated one, and backfills
members who joined before AgentGit captured keys. The welcome email stays gated
on `created`, since the one-time password is only meaningful for a new account.
Two things that would have made this unreliable in the new every-login path:
- The key title was the constant "agentbbs". Forgejo rejects a duplicate title
with 422, so a member who rotated their BBS key would have had the new one
silently dropped. The title now carries a short fingerprint, so distinct keys
coexist and the same key stays stable across logins.
- EnsureKey mapped *every* 422 to "already exists" and returned nil. That hid
genuine rejections forever, which matters far more now the call is on the hot
path. Only "has been used" bodies are swallowed; a rejected key surfaces with
Forgejo's own reason so it lands in the logs.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Add a key-gated `ssh passwd@host` route (alias `password@`) that sets ONE
member-chosen password across every service with its own credential:
- git (Forgejo) new forgejo.SetPassword (PATCH /admin/users, clears
must_change; EnsureUser first so the account exists)
- mail (Mailu webmail) existing mailu.SetPassword
- chat (IRC/Ergo + The Lounge) new internal/ircpass package
Because the route authenticates by the member's registered SSH key, it also
serves as the forgot-password path — no old password required.
The BBS runs as a non-root service user, but the Ergo password store and The
Lounge user files are root-owned. internal/ircpass bridges this by shelling out
to scripts/set-irc-password.sh through a narrow sudoers rule (installed by
setup.sh). The new password travels on stdin (a new `set-irc-password.sh
<member> -` form), so it never appears in the process table or sudo's log.
UX: masked entry typed twice (readSecret); no-PTY reads stdin; empty input
generates a strong password and shows it once. Each service leg is independent
and best-effort with a per-service ✓/✗ summary, plus a confirmation email that
never contains the password.
Tests: ircpass (stdin contract + member/password rejection), forgejo.SetPassword,
auth IsPasswdName + reservation. Docs: credentials.md (passwd@ section) + irc.md.
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
`agentbbs notify-creds` backfills credential emails to verified members
who signed up before the git/mailbox welcome emails existed.
- git (all verified): forgejo.EnsureUserReset resets each account to a
fresh one-time password (must-change) and emails the web login link,
username, and password. New method since the original one-time
password is not recoverable for existing accounts.
- mailbox (all verified): ensures the forwardemail alias and emails the
address + webmail link.
- Preview by default; --send executes. --git/--mail/--user filters.
Refuses --send without SMTP; warns+skips when Forgejo/forwardemail
are unconfigured.
Also folds in the welcome-email functions (gitWelcomeEmailBody,
mailWelcomeEmailBody, EnsureUser password return, provisionGit/
ensurePremium sends) that this builds on. README ops + forgejo tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Make git.profullstack.com a real, key-authenticated git host for every BBS
member ("BBS membership is the git account", SSH-key auth end to end):
- forgejo.EnsureKey: register a member's SSH public key on their Forgejo
account (idempotent, ignores the key comment). So the key they sign in to
the BBS with is also their git push key.
- provisionGit now takes the session public key and registers it after
ensuring the account; called on email verification AND (newly) on every
member login, so members who predate AgentGit — or whose key wasn't
registered yet — are backfilled automatically and off the hot path.
- setup.sh:
- admin token scopes write:admin,read:user,write:user (the old write:admin
alone failed userExists' /users lookup, so provisioning never worked).
- REQUIRE_SIGNIN_VIEW=false so member profiles + public repos are viewable
at git.profullstack.com/<name> (private repos stay private; accounts are
still created only by agentbbs).
- Enable Forgejo's built-in SSH server (port 2222, BUILTIN_SSH_SERVER_USER=git)
and open the firewall, so members push to git@git.profullstack.com:2222.
Verified live: all members provisioned, git.profullstack.com/chovy serves the
profile, and a push over ssh://git@host:2222 with a registered key succeeds.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
