GitHub proxy part 6: proxing Git using SSH transport

[greedy52]

Related:

• GitHub proxy #48762

will stack another PR for tsh git ssh/config/clone commands on top of this

[espadolini]

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

[greedy52]

Are you sure that hooking into lib/srv/forward.Server to essentially add a completely separate mode gated by a flag (or like three different and potentially conflicting flags) is easier than writing something new that's going to be structurally guaranteed to work as intended just for the purpose of forwarding the ssh git protocol?

will do 👍

[greedy52]

i am splitting out some parts of this PR to separate ones like

• GitHub proxy: git command recorder #50505

[public-teleport-github-review-bot]

@greedy52 - this PR will require admin approval to merge due to its size. Consider breaking it up into a series smaller changes.

[greedy52]

@espadolini PTAL

[greedy52]

In general, I wonder about the decision to reuse ssh connection functionality for this. If we ever want to support other protocols then suddenly we need to reinvent a lot of things.

I can't speak for the decision to use the git ssh protocol vs the git http protocol, but if we're going to use the git ssh protocol, reusing our existing SSH transport makes sense IMO. My initial recommendation was to actually make the configuration bits real static nodes in a similar fashion to the openssh ones, but we've decided to use a dedicated configuration type for git servers.

The very first git proxy poc is actually http-based for AWS CodeCommit using AWS app access. But AWS CodeCommit is dead now.

Like Edoardo said, this is what we end up with after a few iterations of poc and RFD discussions. GitLab supports SSH CA as well. Even if we have to do HTTP later, I don't think it's that difficult.

[greedy52]

@espadolini @Tener could you take another look? thanks!

[rosstimothy]

Does this have to happen in CASD?

[greedy52]

I could move it to backend create but I would prefer it here as it should not have other values.

[greedy52]

@r0mant may i get an admin approval for the large size and an excludeflake?

flaky test detector failed on lib/srv/regular due to timeout:

✓  lib/srv/git (4.288s) (coverage: 62.9% of statements)
✓  lib/sshutils (3.388s) (coverage: 7.7% of statements)
✓  lib/proxy (7.197s) (coverage: 28.8% of statements)
✓  lib/srv (7.295s) (coverage: 2.3% of statements)
✓  lib/services (14.516s) (coverage: 3.0% of statements)
✖  lib/srv/regular (10m0.411s) (-test.shuffle 1736869325460463256)

There is no change to that package besides adding a new param to reverse tunnel server to three existing tests.

[r0mant]

/excludeflake *

[r0mant]

Bot.