{"record":{"id":"a508e2326c02df50","repo":"phacility/phabricator","slug":"unable-to-proxy-this-ssh-request-within-the-cluste","errorCode":null,"errorMessage":"Unable to proxy this SSH request within the cluster: this device is not registered and has a missing device key (expected to find key at \"%s\").","messagePattern":"Unable to proxy this SSH request within the cluster: this device is not registered and has a missing device key \\(expected to find key at \"(.+?)\"\\)\\.","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"src/applications/diffusion/ssh/DiffusionSSHWorkflow.php","lineNumber":127,"sourceCode":"\n  final protected function getProxyCommandForServiceRef(\n    DiffusionServiceRef $ref) {\n\n    $uri = new PhutilURI($ref->getURI());\n\n    $username = AlmanacKeys::getClusterSSHUser();\n    if ($username === null) {\n      throw new Exception(\n        pht(\n          'Unable to determine the username to connect with when trying '.\n          'to proxy an SSH request within the cluster.'));\n    }\n\n    $port = $uri->getPort();\n    $host = $uri->getDomain();\n    $key_path = AlmanacKeys::getKeyPath('device.key');\n    if (!Filesystem::pathExists($key_path)) {\n      throw new Exception(\n        pht(\n          'Unable to proxy this SSH request within the cluster: this device '.\n          'is not registered and has a missing device key (expected to '.\n          'find key at \"%s\").',\n          $key_path));\n    }\n\n    $options = array();\n    $options[] = '-o';\n    $options[] = 'StrictHostKeyChecking=no';\n    $options[] = '-o';\n    $options[] = 'UserKnownHostsFile=/dev/null';\n\n    // This is suppressing \"added <address> to the list of known hosts\"\n    // messages, which are confusing and irrelevant when they arise from\n    // proxied requests. It might also be suppressing lots of useful errors,\n    // of course. Ideally, we would enforce host keys eventually. See T13121.\n    $options[] = '-o';","sourceCodeStart":109,"sourceCodeEnd":145,"githubUrl":"https://github.com/phacility/phabricator/blob/5720a38cfe95b00ca4be5016dd0d2f3195f4fa04/src/applications/diffusion/ssh/DiffusionSSHWorkflow.php#L109-L145","documentation":"Intracluster proxying authenticates with the device private key stored at AlmanacKeys::getKeyPath('device.key'). If that file does not exist — the host never registered itself as an Almanac device — proxying cannot proceed and the exception reports the expected key path.","triggerScenarios":"Proxying an SSH repository operation from a cluster host where bin/almanac register was never run, or where the key file was deleted, moved, or made unreadable for the daemon user.","commonSituations":"New cluster nodes added without registration; key rotation that removed old files; daemons running as a user that cannot read the key directory.","solutions":["Run bin/almanac register as the daemon user on this host to generate and register the device key","Verify the path printed in the exception exists and is readable by the daemon user","If keys were rotated, re-register the device and confirm its bindings in the Almanac service"],"exampleFix":"# before\nls <key-path> -> No such file or directory; proxied SSH writes fail\n# after\nsudo -u <daemon-user> ./bin/almanac register","handlingStrategy":"validation","validationCode":"// Ensure the device key exists before proxying\n$key_path = AlmanacKeys::getKeyPath('device.key');\nif (!Filesystem::pathExists($key_path)) {\n  // surface 'run bin/almanac register' guidance instead of failing mid-proxy\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Register every cluster host with bin/almanac register before routing traffic to it","After key rotation or re-imaging, re-register and confirm the key path is readable","Run registration as the daemon user so file ownership stays correct"],"tags":["cluster","almanac","device-key","ssh"],"backgroundTag":"missing-device-key","analyzedSha":"5720a38cfe95b00ca4be5016dd0d2f3195f4fa04","analyzedAt":"2026-08-21T05:07:25.672Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}