firefrost-operations-manual/docs/tasks/vaultwarden-ssh-setup/README.md

Task #14: Store Firefrost SSH Key in Vaultwarden

Status: PENDING
Priority: TIER 0 — FOUNDATIONAL (UNBLOCKS ALL TROUBLESHOOTING)
Time Estimate: 30 minutes
Created: March 20, 2026 (by The Guide, Chronicler #35)

---

OBJECTIVE

Store the Firefrost SSH private key securely in Vaultwarden so future Chroniclers and team members can access all servers for troubleshooting without needing to ask Michael for the key each time.

Why this is critical:

• Unblocks ALL troubleshooting (Ghost, Paymenter, Pterodactyl, game servers)
• Enables real-time debugging without waiting for Michael
• Secure credential sharing with Meg (organization setup)
• Foundation for operational efficiency

Current state: SSH key exists but only on Michael's local machines
After completion: Key accessible via Vaultwarden to authorized team members

---

SERVERS USING THIS KEY

All six Firefrost servers use the SAME SSH key:

1. Ghost VPS (64.50.188.14, Chicago) — Login as architect
2. Billing VPS (38.68.14.188) — Paymenter, Mailcow
3. Panel VPS (45.94.168.138) — Pterodactyl Panel
4. Command Center (63.143.34.217, Dallas) — Gitea, automation
5. TX1 Dallas (38.68.14.26, 251GB RAM) — Wings, Plane, Dify
6. NC1 Charlotte (216.239.104.130, 251GB RAM) — Wings

Key name: Firefrost_key.ppk (PuTTY format)
Algorithm: ssh-rsa
Format: PuTTY Private Key File version 3

---

KEY FILE FORMATS

Two formats needed:

1. PuTTY Format (.ppk)

• For: Windows users using PuTTY
• File: Firefrost_key.ppk
• Current location: Uploaded to operations manual session
• Usage: Load in PuTTY → Connection → SSH → Auth → Private key file

2. OpenSSH Format (no extension or .pem)

• For: Linux/macOS users, Claude sessions with computer use
• File: firefrost_key (no extension) or firefrost_key.pem
• Needs conversion: Use PuTTYgen to convert .ppk → OpenSSH
• Usage: ssh -i ~/.ssh/firefrost_key user@server

---

STEP-BY-STEP: CONVERT & STORE KEY

Step 1: Convert PuTTY Key to OpenSSH Format (Windows)

Using PuTTYgen:

1. Download PuTTYgen (comes with PuTTY installer)
2. Open PuTTYgen
3. Click Load → Select Firefrost_key.ppk
4. Enter passphrase if prompted
5. Click Conversions menu → Export OpenSSH key
6. Save as firefrost_key (no extension)
7. Important: Also save public key via Save public key button

Using puttygen command line (Linux/WSL):

puttygen Firefrost_key.ppk -O private-openssh -o firefrost_key
chmod 600 firefrost_key

Step 2: Log into Vaultwarden

1. Go to: https://vault.firefrostgaming.com (or whatever Vaultwarden URL is)
2. Log in with Michael's account
3. Navigate to vault

Step 3: Create "Firefrost SSH Key" Secure Note

Click: New Item → Secure Note

Fields to fill:

• Name: Firefrost SSH Key (All Servers)
• Folder: Create/select "Infrastructure" folder
• Notes:

SSH Private Key for all Firefrost servers (6 servers, same key)

Servers:
- Ghost VPS (64.50.188.14) - Login as: architect
- Billing VPS (38.68.14.188) - Login as: root
- Panel VPS (45.94.168.138) - Login as: root
- Command Center (63.143.34.217) - Login as: root
- TX1 Dallas (38.68.14.26) - Login as: root
- NC1 Charlotte (216.239.104.130) - Login as: root

Format: PuTTY (.ppk) and OpenSSH
Algorithm: ssh-rsa
Created: [Date key was created]

Attachments:

• Upload Firefrost_key.ppk (PuTTY format)
• Upload firefrost_key (OpenSSH format)
• Upload firefrost_key.pub (public key for reference)

Step 4: Set Permissions

Organization setup (if sharing with Meg):

1. Create organization: "Firefrost Operations"
2. Add Meg to organization
3. Share "Firefrost SSH Key" item with organization
4. Set permissions: Meg can view/use but not delete

Or keep personal:

• Leave in Michael's personal vault
• Share individually when needed

Step 5: Test Retrieval

Test that the key works:

1. Log into Vaultwarden
2. Open "Firefrost SSH Key" item
3. Download the OpenSSH format key
4. Save to ~/.ssh/firefrost_key
5. Set permissions: chmod 600 ~/.ssh/firefrost_key
6. Test SSH: ssh -i ~/.ssh/firefrost_key architect@64.50.188.14
7. Should connect to Ghost VPS without password

Step 6: Document in Ops Manual

Update docs/core/infrastructure-manifest.md:

## SSH Access

**All servers use the same SSH key:**
- Key name: Firefrost SSH Key
- Storage: Vaultwarden (Infrastructure folder)
- Formats: PuTTY (.ppk) and OpenSSH
- Retrieval: vault.firefrostgaming.com → "Firefrost SSH Key (All Servers)"

**To use:**
1. Download key from Vaultwarden
2. Save to ~/.ssh/firefrost_key
3. chmod 600 ~/.ssh/firefrost_key
4. ssh -i ~/.ssh/firefrost_key user@server

---

USAGE INSTRUCTIONS (For Future Chroniclers)

For Computer Use Sessions (Claude):

When Claude needs SSH access:

1. Michael retrieves key from Vaultwarden
2. Michael provides key via file upload to session
3. Claude saves to /home/claude/.ssh/firefrost_key
4. Claude sets permissions: chmod 600 /home/claude/.ssh/firefrost_key
5. Claude can now SSH: ssh -i ~/.ssh/firefrost_key user@server

Server-specific usernames:

• Ghost VPS: ssh -i ~/.ssh/firefrost_key architect@64.50.188.14
• All others: ssh -i ~/.ssh/firefrost_key root@[server-ip]

For Meg (Team Access):

If shared via organization:

1. Log into Vaultwarden
2. Go to Organizations → Firefrost Operations
3. Find "Firefrost SSH Key (All Servers)"
4. Download appropriate format (PuTTY or OpenSSH)
5. Use with SSH client

---

SECURITY CONSIDERATIONS

✅ DO:

• Store in Vaultwarden with strong master password
• Use 2FA on Vaultwarden account
• Set proper file permissions (600) on downloaded keys
• Delete key from download folder after moving to .ssh/
• Use organization for team sharing (audit trail)

❌ DON'T:

• Commit SSH private key to Git (operations manual or any repo)
• Send key via email/Discord/Slack
• Store key in plain text files
• Leave key in ~/Downloads or desktop
• Share master Vaultwarden password

If Key is Compromised:

1. Generate new SSH key pair immediately
2. Update ~/.ssh/authorized_keys on all 6 servers
3. Revoke old key from all servers
4. Update Vaultwarden with new key
5. Notify team of key rotation

---

VERIFICATION CHECKLIST

After completing this task:

• PuTTY key (.ppk) converted to OpenSSH format
• Both formats uploaded to Vaultwarden
• Secure note created with server details
• Permissions set (organization or personal)
• Test retrieval successful
• Test SSH connection to at least one server
• docs/core/infrastructure-manifest.md updated
• Task #14 marked COMPLETE in tasks.md

---

SUCCESS CRITERIA

✅ SSH key stored in Vaultwarden
✅ Both formats available (PuTTY and OpenSSH)
✅ Future Chroniclers can retrieve key without asking Michael
✅ Meg has access (if organization setup complete)
✅ Test connection successful to at least one server
✅ Documentation updated in infrastructure manifest

---

BLOCKS / UNBLOCKS

This task blocks:

• Nothing — can be done independently

This task unblocks:

• All future SSH troubleshooting sessions
• Ghost CMS debugging (log access, config edits)
• Paymenter troubleshooting (database access)
• Pterodactyl Panel fixes
• Game server administration via CLI
• Real-time production debugging

Impact: FOUNDATIONAL — Makes all future server work 10x easier

---

RELATED TASKS

• Task #52: Ghost CMS homepage (may need SSH debugging)
• Task #42: Paymenter configuration (may need SSH access)
• All server administration tasks

---

TECHNICAL NOTES

PuTTY vs OpenSSH formats:

• PuTTY (.ppk): Windows SSH client format
• OpenSSH: Linux/macOS standard format
• NOT COMPATIBLE — must convert between them
• Both needed for cross-platform team access

Key algorithm: ssh-rsa (older but widely supported)
Security: Private key should be protected with passphrase (verify if set)

File permissions matter:

• Too open (644, 755): SSH will reject the key
• Correct (600): Owner read/write only
• Command: chmod 600 ~/.ssh/firefrost_key

---

NEXT STEPS AFTER COMPLETION

1. Mark Task #14 COMPLETE
2. Update infrastructure manifest with retrieval instructions
3. Test key access from fresh session (verify documentation)
4. Consider key rotation schedule (annually?)
5. Document key passphrase location (if exists)

---

Created by: The Guide (Chronicler #35)
Date: March 20, 2026
Priority: TIER 0 — Do this BEFORE soft launch content work
Why: Foundation before expansion — can't troubleshoot effectively without SSH access