SSH Setup

Give Panix SSH key access to your machines and reuse your existing ~/.ssh/config host aliases.

Caution

Panix requires SSH key authentication. Password authentication is not supported.

From Password to Key Auth

If your target machine only has password access, set up a temporary key:

# On remote: set a password for root
sudo passwd

export REMOTE=<host>

# Generate key pair (no passphrase)
ssh-keygen -t ed25519 -f ./temp_key -C "temporary_deployment_key" -N ""

# Copy key to remote
# SSH_AUTH_SOCK="" prevents trying keys from the agent
SSH_AUTH_SOCK="" ssh-copy-id -i ./temp_key.pub \
  -o UserKnownHostsFile=/dev/null \
  -o StrictHostKeyChecking=no \
  root@$REMOTE

Test the connection:

ssh -i ./temp_key -o IdentitiesOnly=yes root@$REMOTE

SSH Config Integration

Panix reads ~/.ssh/config. If your machine name matches a host alias, no connection parameters are needed:

Fragment: nest under fleet.flakes.<flake>.installables.<type>.<name>.machines.

machines:
  production-server-01:     # Uses SSH config: HostName, Port, User (identity file etc. resolved by ssh via the alias)

Your SSH config is the source of truth for connection parameters, no duplication.

If you don’t use SSH config or need to override something temporarily, specify SSH options directly:

Fragment: nest under fleet.flakes.<flake>.installables.<type>.<name>.machines.

machines:
  my-server:
    ssh:
      hostname: 192.168.1.100
      port: 2222
      username: admin
      identity_file: ./keys/server.key
      disable_strict_key_checking: false  # Enable strict host key checking
      disable_auto_add_host_key: false    # Allow auto-adding host keys

Local Machine Detection

If the machine name matches the system hostname, Panix skips SSH entirely and executes commands via local shell:

Fragment: nest under fleet.flakes.<flake>.installables.<type>.<name>.machines.

# On a machine with hostname "workstation"
machines:
  workstation:              # Detected as local, no SSH

To prevent this (or when hostname detection does not work for you), override it:

flags:
  local_machine_hostname: my-local-machine

Forcing SSH to Localhost

To avoid passwordless sudo on your local machine (a security risk on desktops), force Panix to always SSH into it. Set local_machine_hostname to a value that will never match any real hostname:

flags:
  local_machine_hostname: never-match-anything

The sentinel matches no real hostname, so Panix always connects via SSH, even when deploying from the machine itself, relying on key authentication instead of local sudo.