Skip to content
Graft Docs

SSH Key Management

Graft uses SSH keys to securely communicate with your remote servers. The graft pub command simplifies the process of managing these keys.

graft pub

Section titled “graft pub”

This command is used to retrieve or generate an SSH public key that Graft uses for remote operations.

How to use: Run the following command in your terminal:

Terminal window
graft pub

The Workflow:

  1. Check for Existing Key: Graft checks if an SSH key pair already exists in its configuration directory (~/.graft/graftpub and ~/.graft/graftpem).
  2. Generate New Key: If no key is found, Graft automatically generates a secure ED25519 SSH key pair.
  3. Output Public Key: The command prints the public key to your terminal.

Why is this needed?

Section titled “Why is this needed?”

Before you can initialize a host with graft init or graft host init, the target server needs to authorize your Graft SSH key.

Steps to Authorize:

  1. Run graft pub to get your public key.
  2. Copy the output string.
  3. Add this string to the ~/.ssh/authorized_keys file on your remote server.

graft pub rollout

Section titled “graft pub rollout”

Rotate your Graft SSH keys across all linked servers automatically.

How to use:

Terminal window
graft pub rollout

The Workflow:

  1. Backup & Load: Graft loads your current SSH key pair.
  2. Generate New Key: A new secure ED25519 key pair is generated in memory.
  3. Identify Servers: Graft scans your Global Registry to find all servers that use the current Graft key.
  4. Remote Update: Graft connects to each server using the old key and updates the authorized_keys file to include the new key.
  5. Local Sync: Once all servers are updated (or attempted), Graft replaces the old keys on your local machine with the new ones.