From 2a582782f28636fe92dedf02a1437be97f6e8d1d Mon Sep 17 00:00:00 2001
From: dawn <90008@klbr.net>
Date: Sat, 26 Sep 2026 13:42:07 +0300
Subject: [PATCH] spindle-hel: enable debug ssh

Signed-off-by: dawn <dawn@tangled.org>
---
 flake.nix                              |  1 +
 hosts/spindle-hel/configuration.nix    |  1 +
 hosts/spindle-hel/services/spindle.nix | 10 ++++++++++
 3 files changed, 12 insertions(+)

diff --git a/flake.nix b/flake.nix
index 605e100..96c5060 100644
--- a/flake.nix
+++ b/flake.nix
@@ -200,6 +200,7 @@
           ./hosts/spindle-hel/services/nginx.nix
         ];
         target = "135.181.240.228";
+        port = 2222;
       };
 
       prometheus-hel = {
diff --git a/hosts/spindle-hel/configuration.nix b/hosts/spindle-hel/configuration.nix
index 01998fa..4e63615 100644
--- a/hosts/spindle-hel/configuration.nix
+++ b/hosts/spindle-hel/configuration.nix
@@ -1,6 +1,7 @@
 {...}: {
   imports = [./disk-config.nix];
   networking.hostName = "spindle-hel";
+  services.openssh.ports = [2222];
   users.users.tangler.extraGroups = ["docker"];
   networking.dhcpcd.denyInterfaces = [ "veth*" "br-*" "docker*" ];
   networking.nameservers = [ "1.1.1.1" "8.8.8.8" ];
diff --git a/hosts/spindle-hel/services/spindle.nix b/hosts/spindle-hel/services/spindle.nix
index dc14f6e..5187312 100644
--- a/hosts/spindle-hel/services/spindle.nix
+++ b/hosts/spindle-hel/services/spindle.nix
@@ -45,6 +45,8 @@
 
     mill = {
       artifactStore = "s3";
+      jumpListenAddr = "0.0.0.0:22";
+      jumpHostKeyPath = "/var/lib/spindle/debug_jump_host_key";
 
       executors.hel-1 = {
         tokenFile = "/var/lib/secrets/spindle-executor-hel-1.token";
@@ -87,6 +89,11 @@
           enable = true;
           swapMaxMiB = 512; # don't let workflows use too much swap, will be too slow
         };
+        debugSsh = {
+          enable = true;
+          jumpHost = "debug@spindle.tangled.sh";
+          host = "hel-1";
+        };
       };
       nixCache = {
         readUrls = [
@@ -109,5 +116,8 @@
     "L+ /var/lib/spindle/images/alpine - - - - /var/lib/spindle/images/alpine-x86_64"
   ];
 
+  networking.hosts."127.0.0.1" = ["hel-1"];
+
+  networking.firewall.allowedTCPPorts = [22];
   networking.firewall.interfaces."tailscale0".allowedTCPPorts = [9091 9092];
 }
-- 
2.51.2