Connect to a server (SSH)
=========================

.. admonition:: One-time setup

   Ask a systems administrator to add :ref:`your public SSH key<add-public-key>` to the relevant ``ssh`` list in the server's Pillar file.

On machines running Docker, use SSH as usual. For example:

.. code-block:: bash

   ssh USER@ocp99.open-contracting.org

On machines not running Docker, the SSH port is closed by default. The easiest way to open it depends on whether your IP address is dynamic or static.

Dynamic IP: Port knock
----------------------

To open the SSH port for 30 seconds, send traffic to port 8255, replacing ``example.open-contracting.org`` with the server you want to connect to:

.. code-block:: bash

   curl --silent --connect-timeout 1 ocp99.open-contracting.org:8255 || true

You can then use ``ssh`` as usual. Once you're connected, the server will close the port, but not your connection.

.. note::

   Port 8255 returns no data. Without ``--connect-timeout 1``, curl waits forever for a response.

Static IP: Allow list
---------------------

#. Add your IP address(es) to the ``ssh_ipv4`` and ``ssh_ipv6`` list(s) in the `common <https://github.com/open-contracting/deploy-pillar-private/blob/main/common.sls>`__ private Pillar file
#. Add your full name in a comment
#. :doc:`Deploy all services<../deploy/deploy>`

If you're unsure, contact sysadmin@open-contracting.org.