{"record":{"id":"09f7ba1fadb00e80","repo":"phacility/phabricator","slug":"unable-to-determine-the-username-to-connect-with-w","errorCode":null,"errorMessage":"Unable to determine the username to connect with when trying to proxy an SSH request within the cluster.","messagePattern":"Unable to determine the username to connect with when trying to proxy an SSH request within the cluster\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":117,"sourceCode":"    return $refs;\n  }\n\n  final protected function getProxyCommand($for_write) {\n    $refs = $this->getAlmanacServiceRefs($for_write);\n\n    $ref = head($refs);\n\n    return $this->getProxyCommandForServiceRef($ref);\n  }\n\n  final protected function getProxyCommandForServiceRef(\n    DiffusionServiceRef $ref) {\n\n    $uri = new PhutilURI($ref->getURI());\n\n    $username = AlmanacKeys::getClusterSSHUser();\n    if ($username === null) {\n      throw new Exception(\n        pht(\n          'Unable to determine the username to connect with when trying '.\n          'to proxy an SSH request within the cluster.'));\n    }\n\n    $port = $uri->getPort();\n    $host = $uri->getDomain();\n    $key_path = AlmanacKeys::getKeyPath('device.key');\n    if (!Filesystem::pathExists($key_path)) {\n      throw new Exception(\n        pht(\n          'Unable to proxy this SSH request within the cluster: this device '.\n          'is not registered and has a missing device key (expected to '.\n          'find key at \"%s\").',\n          $key_path));\n    }\n\n    $options = array();","sourceCodeStart":99,"sourceCodeEnd":135,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L99-L135","documentation":"To proxy an SSH request to another cluster node, this host must connect as its device account; the username comes from the diffusion.ssh-user config via AlmanacKeys::getClusterSSHUser(). If that setting is unset or empty, there is no account to connect as and this exception is thrown.","triggerScenarios":"Any intracluster SSH push or pull (repository on an Almanac cluster service) on an installation where diffusion.ssh-user was never configured.","commonSituations":"Clusters set up following the device/keys steps but skipping the SSH user config; configuration lost during migrations.","solutions":["Set the cluster SSH user on every node: bin/config set diffusion.ssh-user <user> (commonly 'git')","Make sure that username matches sshd AcceptUsers and the device keys installed for that user","Retry the push/pull after saving the config"],"exampleFix":"# before\ndiffusion.ssh-user is unset -> intracluster SSH proxying throws\n# after\n./bin/config set diffusion.ssh-user git","handlingStrategy":"validation","validationCode":"// Guard before attempting to proxy\n$username = PhabricatorEnv::getEnvConfig('diffusion.ssh-user');\nif ($username === null || !strlen($username)) {\n  // block proxying with a clear 'set diffusion.ssh-user' setup message\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set diffusion.ssh-user on every cluster node during initial cluster setup","Include the config in infrastructure-as-state so migrations do not drop it","Verify the username matches sshd AcceptUsers and the device authorized_keys"],"tags":["cluster","config","ssh"],"backgroundTag":"missing-cluster-ssh-user","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}