Commit `0dd284d9dd`

0dd284d9dd4f118cb63b634618d99963eeb660f8

parent: 01ced7ef9e

Verified · cmc ci/build: success ci/test: success ci/vuln: success

cmc <hello@cleberg.net> · 2026-09-03 15:40 UTC

cli: share one SSH connection per instance

Every command spawned a fresh ssh and paid a full handshake, 3.8 s from
a laptop 170 ms away from the instance. sshArgs now passes
ControlMaster=auto with a socket under ~/.ssh and ControlPersist=300,
so the first command in five minutes pays the handshake and the rest
ride it: 0.36 s for the same command. The profile's ssh_options still
come last and win; no_multiplex = true on an instance opts out, and no
~/.ssh directory means no multiplexing.

Closes #94

Layout: unified · split

cmd/gitbay/local.go +1 −5

 // captureSSH runs a server command and returns its stdout.
 func captureSSH(t target, serverArgv []string) (string, int) {
-	args := []string{}
+	args := sshArgs(t.inst)
-	if t.inst.Port != 0 && t.inst.Port != 22 {
-		args = append(args, "-p", fmt.Sprint(t.inst.Port))
-	}
-	args = append(args, t.inst.SSHOptions...)
 	quoted := quoteAll(serverArgv)
 	args = append(args, t.inst.SSHUser()+"@"+t.inst.Host, "--", strings.Join(quoted, " "))
 	cmd := exec.Command("ssh", args...)

cmd/gitbay/ssh.go +29 −10

 	"io"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"regexp"
 	"strconv"
 	"strings"
 	return "'" + strings.ReplaceAll(arg, "'", `'\''`) + "'"
 }
+// sshArgs is every argument before the destination: the port, connection
+// multiplexing, and the profile's own options last so they win.
+//
+// Multiplexing is what makes a CLI over SSH usable: without it every
+// command pays a full handshake, seconds on a distant instance, and with
+// it the second command in five minutes rides the first's connection
+// (#94). The control socket lives under ~/.ssh, which ssh requires to be
+// private; a profile can set no_multiplex = true to opt out.
+func sshArgs(inst cliconfig.Instance) []string {
+	args := []string{}
+	if inst.Port != 0 && inst.Port != 22 {
+		args = append(args, "-p", strconv.Itoa(inst.Port))
+	}
+	if !inst.NoMultiplex {
+		if home, err := os.UserHomeDir(); err == nil {
+			if st, err := os.Stat(filepath.Join(home, ".ssh")); err == nil && st.IsDir() {
+				args = append(args,
+					"-o", "ControlMaster=auto",
+					"-o", "ControlPath="+filepath.Join(home, ".ssh", "gitbay-%C"),
+					"-o", "ControlPersist=300")
+			}
+		}
+	}
+	return append(args, inst.SSHOptions...)
+}
 // runSSH executes the server command over the system ssh binary, wiring
 // stdio through. It returns the remote exit code.
 func runSSH(t target, serverArgv []string, stdin io.Reader) int {
-	args := []string{}
+	args := sshArgs(t.inst)
-	if t.inst.Port != 0 && t.inst.Port != 22 {
-		args = append(args, "-p", strconv.Itoa(t.inst.Port))
-	}
-	args = append(args, t.inst.SSHOptions...)
 	quoted := make([]string, len(serverArgv))
 	for i, a := range serverArgv {
 		quoted[i] = shellQuote(a)
 // sshCapture runs a server command and returns its stdout, discarding
 // stderr. Used for quiet metadata fetches like issue templates.
 func sshCapture(t target, serverArgv []string) (string, int) {
-	args := []string{}
+	args := sshArgs(t.inst)
-	if t.inst.Port != 0 && t.inst.Port != 22 {
-		args = append(args, "-p", strconv.Itoa(t.inst.Port))
-	}
-	args = append(args, t.inst.SSHOptions...)
 	quoted := make([]string, len(serverArgv))
 	for i, a := range serverArgv {
 		quoted[i] = shellQuote(a)

cmd/gitbay/sshargs_test.go added +43

@@ -0,0 +1,43 @@
	1	package main
	2
	3	import (
	4	"os"
	5	"path/filepath"
	6	"slices"
	7	"strings"
	8	"testing"
	9
	10	"gitbay.org/gitbay/internal/cliconfig"
	11	)
	12
	13	// Every ssh the CLI spawns shares one connection per instance, so a
	14	// command costs a round trip rather than a handshake (#94). The socket
	15	// sits under ~/.ssh; with no such directory, or no_multiplex set, the
	16	// arguments are the plain ones.
	17	func TestSSHArgsMultiplex(t *testing.T) {
	18	home := t.TempDir()
	19	t.Setenv("HOME", home)
	20	inst := cliconfig.Instance{Host: "forge.test", Port: 2222, SSHOptions: []string{"-i", "k"}}
	21
	22	if args := sshArgs(inst); slices.Contains(args, "ControlMaster=auto") {
	23	t.Errorf("multiplexing without ~/.ssh: %v", args)
	24	}
	25	os.Mkdir(filepath.Join(home, ".ssh"), 0o700)
	26
	27	args := sshArgs(inst)
	28	joined := strings.Join(args, " ")
	29	for _, want := range []string{"-p 2222", "ControlMaster=auto", "ControlPersist=300",
	30	"ControlPath=" + filepath.Join(home, ".ssh", "gitbay-%C")} {
	31	if !strings.Contains(joined, want) {
	32	t.Errorf("missing %q in %v", want, args)
	33	}
	34	}
	35	if args[len(args)-2] != "-i" \|\| args[len(args)-1] != "k" {
	36	t.Errorf("profile options are not last: %v", args)
	37	}
	38
	39	inst.NoMultiplex = true
	40	if args := sshArgs(inst); slices.Contains(args, "ControlMaster=auto") {
	41	t.Errorf("no_multiplex ignored: %v", args)
	42	}
	43	}

internal/cliconfig/cliconfig.go +4

 	// e.g. ["-i", "~/.ssh/forge_ed25519"]. Most setups need none: the
 	// system ssh already honors ~/.ssh/config and the agent.
 	SSHOptions []string `toml:"ssh_options,omitempty"`
+	// NoMultiplex turns off SSH connection sharing for this instance. On
+	// by default: one handshake per five minutes instead of one per
+	// command.
+	NoMultiplex bool `toml:"no_multiplex,omitempty"`
 }
 func (i Instance) SSHUser() string {

Commit 0dd284d9dd

Commit `0dd284d9dd`