From 4ead5a3d17793b3a0a5f77ccb49572efa5c80fe9 Mon Sep 17 00:00:00 2001 From: Joshua Gilman Date: Fri, 16 Oct 2026 19:24:04 -0700 Subject: [PATCH] docs(windows): add key-only SSH access to the Windows VM runbook --- docs/docs/runbooks/windows-vm.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/docs/runbooks/windows-vm.md b/docs/docs/runbooks/windows-vm.md index 1525fe4..024e724 100644 --- a/docs/docs/runbooks/windows-vm.md +++ b/docs/docs/runbooks/windows-vm.md @@ -13,6 +13,7 @@ reach it through `gw01`. The OpenTofu root is `GilmanLab/fleet` | Access | Value | | --- | --- | | Remote Desktop | `10.10.50.30` | +| SSH (PowerShell, key-only) | `ssh -i ~/.ssh/win01 josh@10.10.50.30` | | Administrator | `josh`, password in `GilmanLab/secrets` `services/windows/win01.sops.yaml` | ## Preconditions @@ -81,6 +82,18 @@ just remove-install-media The media library is available read-only at `\\10.10.50.20\media` with the `media` account from the media stack runbook. +For commands, SSH in with the operator key; the session is PowerShell: + +```bash +ssh -i ~/.ssh/win01 -o IdentitiesOnly=yes josh@10.10.50.30 +``` + +The server accepts only the key in the `incus/windows` `ssh_authorized_key` +variable; password and keyboard-interactive logins are disabled. To rotate +the key, write the new public key to +`C:\ProgramData\ssh\administrators_authorized_keys` and update the variable +so a rebuilt VM gets it. + ## Activate **Settings → System → Activation → Change product key**, enter the purchased