Open Threads – zlh-grind

This file tracks items that are unresolved, under investigation, or explicitly deferred.

Backend/Infrastructure Threads

Status: ACTIVE - blocking external user access
External SSH to bastion (both IP and hostname) fails with kex_exchange_identification: Connection closed
TCP connection succeeds but SSH handshake never proceeds
Internal SSH works perfectly; issue is specific to WAN→bastion path
Action required:
- tcpdump on bastion during external connection
- OPNsense live log during attempt
- Verify NAT reaching bastion sshd vs upstream termination
- Check for ISP/modem interference

Status: OPEN - built and deployed, but has bugs
When running ON bastion, CLI incorrectly tries to jump via public hostname
Should use localhost/direct connection when already on bastion
User/host targeting logic needs correction (was targeting bastion instead of dev container)
Goal: clean UX like zlh ssh 6038 instead of full jump command

Status: OPEN - manual workaround confirmed, needs agent integration
Requirements:
- Install and enable sshd in new containers
- Generate SSH host keys if missing (add to bootstrap/common.sh)
- Create devuser with sudo access
- Configure authorized_keys for key-based auth (if applicable)
Currently working internally via manual setup; needs to be automatic