OPENSSH WITH SWAMP

The fleet extension

The @swamp/ssh extension provides most of this work. Its behavior type keeps the fleet in the hosts global argument and the fleet-wide connection defaults in transport: user, port, identity, proxy jump, authentication mode and ControlMaster settings. Any host can override those defaults. Hosts can connect over OpenSSH or over Tailscale SSH, and one fleet can mix the two.

The type's methods cover the usual remote operations. exec and script run commands, copy moves files with scp or rsync, and forward opens port forwards. open, check and close manage ControlMaster sockets, and collect-host-public-key reads each host's SSH host key and its SHA256 fingerprint. The resolve method reports which hosts a selector matches without connecting to any of them. A selector can be a host name, a tag, a list of names, all, or a CEL expression with the cel: prefix.

Every host that a method touches writes a run-<method>-<host> resource tagged with the fleet, host, method and exit code. exec and script accept okExitCodes, so a guard command such as test -f can exit 1 and still count as an answer. The guide Run a guarded command across tagged SSH hosts shows this pattern. Record SSH host key fingerprints for a fleet shows how to store each host's key as data.

Other SSH extensions

Several other extensions cover narrower jobs:

• @hivemq/ssh/authorized-keys declares which public keys must be present or absent on every host, then audits, verifies, adds, strips or seals authorized_keys files to match.
• @hivemq/hetzner/ssh/authorized-keys audits and verifies authorized_keys on Hetzner servers, with optional password authentication through sshpass.
• @hivemq/ssh/keygen generates an ed25519 key pair and stores the private key in a Swamp vault. @hivemq/ssh/rotate-config records the vault key names that a rotation workflow reads.
• @keeb/ssh runs commands on a single host, uploads files to it and waits for it to become reachable.
• @evrardjp/ssh-ca manages an OpenSSH certificate authority: certificates, trust lines and key revocation lists.

The guide Enforce authorized_keys across hosts with Swamp uses @hivemq/ssh/authorized-keys. The extensions reference lists every type, global argument and method.

Where to start

If you have not used these extensions before, the getting started tutorial walks through declaring a three-host fleet, resolving selectors against it and running a command on the matched hosts. Understanding SSH automation in Swamp covers why fleets are modelled this way, how credentials stay in vaults, and how to choose between the extensions.