Git over SSH

Clone, fetch and push over SSH with a key registered on your account. Every SSH request is checked the way HTTPS requests are: the same permissions, limits and answers.

git clone git@ssh.rebasely.com:<org>/<repo>.git
git clone ssh://git@ssh.rebasely.com/<org>/<repo>.git

Set it up

The Rebasely CLI creates a key, asks you to approve it in the browser, writes the host keys and adds a block at the top of ~/.ssh/config:

curl -fsSL https://rebasely.com/install | sh
rebasely ssh setup

The CLI stays in ~/.rebasely/rebasely.mjs (or in ~/.duragit/ if you installed it before the rename to Rebasely), where ssh runs it for each connection. Or add the contents of your .pub file in your SSH key settings.

Host keys

Check that ssh shows one of these fingerprints the first time it connects. rebasely ssh setup writes them for you from /docs/ssh/known_hosts, so you never accept an unknown key.

Algorithm	Fingerprint	State
Ed25519	SHA256:u2cDWYXb8m9Y6CU07vpIL5OT0ZRnFu4tkSEKG3FOTiw	Active
ECDSA P-256	SHA256:pxXTJ4zk89dv8+fbHwAdiTfHql73kbLFqkzZCE4zchw	Active
RSA	SHA256:fbkrTu0WSHG2muDVyyiej4xVMUqInMhVAqfOOlxYHHU	Active

A key marked next is announced to clients before it replaces an active one; OpenSSH learns it on its own (UpdateHostKeys).

Configure ssh yourself

Put the block for ssh.rebasely.com before any Host * block: ssh uses the first value it finds for each option, so settings in an earlier Host * would win.

Host ssh.rebasely.com
  User git
  IdentityFile ~/.ssh/id_ed25519
  IdentitiesOnly yes
  AddKeysToAgent yes
  ControlMaster auto
  ControlPath ~/.ssh/cm-%C
  ControlPersist 3s

IdentitiesOnly yes offers only that key. An agent that offers many keys can run out of tries before it reaches the right one.
AddKeysToAgent yes keeps a key with a passphrase unlocked: the server waits only 10 seconds for you to sign in.
The Control lines let commands that follow each other share one connection, such as the many small fetches of git log -p or git blame in a --filter=blob:none clone. Keep ControlPersist under 10 seconds: the server closes a connection that has had no command for 10 seconds.
For many git commands in parallel, such as a build that fetches dozens of repositories at once, use HTTPS with an access token.

Why a connection is refused

Before ssh signs in, Rebasely may end the connection with one line, Rebasely: SSH connection refused (<reason>). What each reason means:

Reason	What happened	What to do
ssh_off	SSH is paused on Rebasely.	Clone and push over HTTPS with an access token until it is back.
relay_off, relay_cap	The relay on port 22 is paused (switched off, or its monthly allowance is used up).	Run rebasely ssh setup, whose direct path keeps working, or use HTTPS.
direct_off, direct_budget	The direct path that rebasely ssh setup configures is paused.	Run rebasely ssh setup --relay to use port 22, or use HTTPS.
term_budget	SSH's monthly allowance is used up on both paths.	Use HTTPS until the start of next month.
rate_limited, ip_limit, preauth_limit, ip_blocked	Too many connections from your address, or too many that ended without signing in.	Close other SSH sessions and wait up to 10 minutes; a blocked address is let in again after 10 minutes.
busy, term_start, meter_unavailable, flags_unreadable	Rebasely could not start your connection just now.	Retry in a minute.

Why a key is refused

ssh prints Permission denied (publickey) when the key it offered is not an active key on a Rebasely account: it was never added, it was removed or blocked, it expired, it was created before you signed out everywhere, or the account is suspended. Check your keys, and run ssh -T git@ssh.rebasely.com, which greets you by account when the key works.

Adding a key fails for these keys, each with its own message:

DSA keys, and RSA keys shorter than 2048 bits. Generate a new key with ssh-keygen -t ed25519.
SSH certificates (*-cert-v01@openssh.com). Add the plain public key.
Lines with options before the key type, such as from="...". Add the key line alone.
A key already active on another Rebasely account: a key works for one account only. Remove it there, or generate a new key for this account.
A key whose private half was pushed to a repository: it is blocked for good. Generate a new one.

Repository not found means the repository does not exist or the key cannot read it, for example because the key is limited to another organization or an owner blocked it there.