phacility/phabricator · error · Exception

Unable to proxy this SSH request within the cluster: this de

Error message

Unable to proxy this SSH request within the cluster: this device is not registered and has a missing device key (expected to find key at "%s").

What it means

Intracluster proxying authenticates with the device private key stored at AlmanacKeys::getKeyPath('device.key'). If that file does not exist — the host never registered itself as an Almanac device — proxying cannot proceed and the exception reports the expected key path.

Source

Thrown at src/applications/diffusion/ssh/DiffusionSSHWorkflow.php:127

  final protected function getProxyCommandForServiceRef(
    DiffusionServiceRef $ref) {

    $uri = new PhutilURI($ref->getURI());

    $username = AlmanacKeys::getClusterSSHUser();
    if ($username === null) {
      throw new Exception(
        pht(
          'Unable to determine the username to connect with when trying '.
          'to proxy an SSH request within the cluster.'));
    }

    $port = $uri->getPort();
    $host = $uri->getDomain();
    $key_path = AlmanacKeys::getKeyPath('device.key');
    if (!Filesystem::pathExists($key_path)) {
      throw new Exception(
        pht(
          'Unable to proxy this SSH request within the cluster: this device '.
          'is not registered and has a missing device key (expected to '.
          'find key at "%s").',
          $key_path));
    }

    $options = array();
    $options[] = '-o';
    $options[] = 'StrictHostKeyChecking=no';
    $options[] = '-o';
    $options[] = 'UserKnownHostsFile=/dev/null';

    // This is suppressing "added <address> to the list of known hosts"
    // messages, which are confusing and irrelevant when they arise from
    // proxied requests. It might also be suppressing lots of useful errors,
    // of course. Ideally, we would enforce host keys eventually. See T13121.
    $options[] = '-o';

View on GitHub (pinned to 5720a38cfe)

Solutions

1. Run bin/almanac register as the daemon user on this host to generate and register the device key
2. Verify the path printed in the exception exists and is readable by the daemon user
3. If keys were rotated, re-register the device and confirm its bindings in the Almanac service

Example fix

# before
ls <key-path> -> No such file or directory; proxied SSH writes fail
# after
sudo -u <daemon-user> ./bin/almanac register

// Ensure the device key exists before proxying
$key_path = AlmanacKeys::getKeyPath('device.key');
if (!Filesystem::pathExists($key_path)) {
  // surface 'run bin/almanac register' guidance instead of failing mid-proxy
}

When it happens

Trigger: Proxying an SSH repository operation from a cluster host where bin/almanac register was never run, or where the key file was deleted, moved, or made unreadable for the daemon user.

Common situations: New cluster nodes added without registration; key rotation that removed old files; daemons running as a user that cannot read the key directory.

Related errors

• Failed to generate an intracluster proxy URI even though thi
• This host has device ID "%s", but there is no corresponding
• Failed to load repository cluster service.
• Repository "%s" exists on more than one device, but no devic
• Repository "%s" is being synchronized on device "%s", but th

AI-assisted analysis of phacility/phabricator@5720a38cfe (2026-08-21). Data as JSON: /api/errors/a508e2326c02df50. Report an issue: GitHub.