orchard controller run: introduce --insecure-ssh-no-client-auth (#187)

internal/controller/controller.go

@@ -59,9 +59,10 @@ type Controller struct {
 	workerOfflineTimeout time.Duration
 	maxWorkersPerLicense uint
 
-	sshListenAddr string
-	sshSigner     ssh.Signer
-	sshServer     *sshserver.SSHServer
+	sshListenAddr   string
+	sshSigner       ssh.Signer
+	sshNoClientAuth bool
+	sshServer       *sshserver.SSHServer
 
 	rpc.UnimplementedControllerServer
 }
@@ -124,7 +125,7 @@ func New(opts ...Option) (*Controller, error) {
 	// Instantiate the SSH server (if configured)
 	if controller.sshListenAddr != "" && controller.sshSigner != nil {
 		controller.sshServer, err = sshserver.NewSSHServer(controller.sshListenAddr, controller.sshSigner,
-			store, controller.proxy, controller.workerNotifier, controller.logger)
+			store, controller.proxy, controller.workerNotifier, controller.sshNoClientAuth, controller.logger)
 		if err != nil {
 			return nil, err
 		}

internal/controller/option.go

@@ -27,10 +27,11 @@ func WithTLSConfig(tlsConfig *tls.Config) Option {
 	}
 }
 
-func WithSSHServer(listenAddr string, signer ssh.Signer) Option {
+func WithSSHServer(listenAddr string, signer ssh.Signer, noClientAuth bool) Option {
 	return func(controller *Controller) {
 		controller.sshListenAddr = listenAddr
 		controller.sshSigner = signer
+		controller.sshNoClientAuth = noClientAuth
 	}
 }
 

internal/controller/sshserver/sshserver.go

@@ -42,6 +42,7 @@ func NewSSHServer(
 	store storepkg.Store,
 	proxy *proxypkg.Proxy,
 	workerNotifier *notifier.Notifier,
+	noClientAuth bool,
 	logger *zap.SugaredLogger,
 ) (*SSHServer, error) {
 	server := &SSHServer{
@@ -58,6 +59,7 @@ func NewSSHServer(
 	server.listener = listener
 
 	server.serverConfig = &ssh.ServerConfig{
+		NoClientAuth:     noClientAuth,
 		PasswordCallback: server.passwordCallback,
 	}
 	server.serverConfig.AddHostKey(signer)