From 7624f46fad974880f3169d43b0638e9f38d64565 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=D0=90=D0=BD=D0=B4=D1=80=D0=B5=D0=B9=20=D0=91=D0=BE=D0=B1?=
 =?UTF-8?q?=D1=8B=D1=80=D0=B5=D0=B2?= <andrejbobyrev@MacBook-Pro.local>
Date: Wed, 29 Apr 2026 16:32:49 +0300
Subject: [PATCH] fix(ssh): ignore known_hosts to avoid host key mismatch

Use UserKnownHostsFile=/dev/null and GlobalKnownHostsFile=/dev/null for sshpass-based connections, so REMOTE HOST IDENTIFICATION HAS CHANGED does not break router actions.

Made-with: Cursor
---
 server/main.py | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/server/main.py b/server/main.py
index 7314752..b36b525 100644
--- a/server/main.py
+++ b/server/main.py
@@ -74,12 +74,18 @@ async def _ssh_on_router(rcfg: dict, remote_cmd: str, timeout: int = 45) -> tupl
             pass
     user = rcfg.get("user") or config.SSH_USER
     pwd = rcfg.get("password") or config.SSH_PASS
+    ssh_opts = [
+        "-o", "StrictHostKeyChecking=no",
+        "-o", "UserKnownHostsFile=/dev/null",
+        "-o", "GlobalKnownHostsFile=/dev/null",
+        "-o", "LogLevel=ERROR",
+    ]
     try:
         r = await asyncio.to_thread(
             subprocess.run,
             [
                 "sshpass", "-p", pwd,
-                "ssh", "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=12",
+                "ssh", *ssh_opts, "-o", "ConnectTimeout=12",
                 *extra_args,
                 f"{user}@{ssh_host}", remote_cmd,
             ],
@@ -100,6 +106,12 @@ async def _push_one_router(server_url: str, router_key: str, rcfg: dict) -> dict
         return {"router": router_key, "ok": False, "msg": "нет IP и нет тоннеля"}
     user = rcfg.get("user") or config.SSH_USER
     pwd = rcfg.get("password") or config.SSH_PASS
+    ssh_opts = [
+        "-o", "StrictHostKeyChecking=no",
+        "-o", "UserKnownHostsFile=/dev/null",
+        "-o", "GlobalKnownHostsFile=/dev/null",
+        "-o", "LogLevel=ERROR",
+    ]
     cmd = (
         f"curl -sf '{server_url}/hydra/domain.conf' -o /opt/etc/HydraRoute/domain.conf && "
         f"curl -sf '{server_url}/hydra/ip.list' -o /opt/etc/HydraRoute/ip.list && "
@@ -107,7 +119,7 @@ async def _push_one_router(server_url: str, router_key: str, rcfg: dict) -> dict
     )
     if tunnel_port:
         ssh_cmd = ["sshpass", "-p", pwd, "ssh",
-                   "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10",
+                   *ssh_opts, "-o", "ConnectTimeout=10",
                    "-p", str(int(tunnel_port)), f"{user}@127.0.0.1", cmd]
     else:
         port_args: list[str] = []
@@ -118,7 +130,7 @@ async def _push_one_router(server_url: str, router_key: str, rcfg: dict) -> dict
         except Exception:
             port_args = []
         ssh_cmd = ["sshpass", "-p", pwd, "ssh",
-                   "-o", "StrictHostKeyChecking=no", "-o", "ConnectTimeout=10",
+                   *ssh_opts, "-o", "ConnectTimeout=10",
                    *port_args,
                    f"{user}@{ip}", cmd]
     try: