~MakerFX Makerspace

Joining the tilde

You need an SSH key to get an account. There are no passwords here — a key is both more secure and less annoying, since you never type anything to log in.

A key comes in two halves. You keep one forever and never send it anywhere:

id_ed25519.pub    PUBLIC   -- safe to share
id_ed25519        PRIVATE  -- NEVER send this. Not to us, not to anyone.

1. Make a key

Every current operating system has the tool built in. Open a terminal — Terminal on macOS, PowerShell on Windows, whatever you use on Linux — and run:

ssh-keygen -t ed25519 -C "yourname@makerfx"

Press enter at each prompt to accept the defaults.

If it asks "Overwrite (y/n)?", answer n. That means you already have a key, and overwriting it would break your access to everything else that uses it. You already have what you need — go to step 2.

You will be asked for a passphrase. It is optional. A passphrase protects the key if your laptop is stolen, at the cost of typing it — see "Not typing your passphrase" below, which removes that cost almost entirely.

2. Apply

ssh -p 2222 join@kerf.ides.club

That is the whole thing. It asks for a username, what to call you, how to reach you, your MakerFX Slack handle, and a couple of sentences about why you want an account. Then an admin reads it.

The Slack handle is optional, and it ends up in ~/.slackuser on the tilde once your account exists — readable by other members, like your ~/.plan, so people can find you off the box. Delete the file if you would rather it were not there; nothing rewrites it.

You are never asked to paste your key, and you should never be. Connecting is itself how we get it — your public half is part of every SSH connection you make, so it arrives on its own. Anyone who asks you to paste a key into a form, an email or a chat is asking for something we do not need. Anyone who asks for the half without .pub is asking for something you must never give.

Already have GitHub? Mention your username in the "why" — we can pull the keys you publish there too, which saves you doing this again on another machine.

3. Wait

An admin approves applications by hand, so give it a day or two. Once approved you log in with the same key you applied with:

ssh -p 2222 yourname@kerf.ides.club

There is nothing to install and nothing to configure. If you have not heard back after a few days, ask at https://makerfx.org.

If you have no terminal

Both steps above need an SSH client. A tablet, a phone or a locked-down Chromebook can still do all of it, and you still generate the key yourself:

Chromebook   Turn on the Linux development environment in Settings, then
             use the command above.
iPhone/iPad  Blink Shell or Termius. Both generate a key for you and will
             show you the public half to send.
Android      Install Termux, then use the command above.

If none of that is workable, an admin can make the key for you on the server and send it to you over magic-wormhole, which is encrypted end to end and uses a one-time code. You will need it installed:

sudo apt install magic-wormhole      # Debian, Ubuntu
brew install magic-wormhole          # macOS
pipx install magic-wormhole          # anywhere with Python

Then, while on the phone or standing next to them, run:

wormhole receive

It asks for a code. The admin reads you something like 4-armistice-swelter. Type it in and a file called id_ed25519 lands in the current directory:

mkdir -p ~/.ssh && mv id_ed25519 ~/.ssh/ && chmod 600 ~/.ssh/id_ed25519
ssh-keygen -p -f ~/.ssh/id_ed25519       # add a passphrase, optional

This is the last-resort path, and it is worth knowing why: it is the only way of joining where somebody other than you has held your private key, even briefly. It is fine — but when you are settled, make a key of your own with the instructions above and swap it in by editing ~/.ssh/authorized_keys yourself. You do not need an admin for that.

Not typing your passphrase every time

If you set one, hand the key to your ssh agent once per login and it stops asking:

ssh-add ~/.ssh/id_ed25519                    # Linux, Windows
ssh-add --apple-use-keychain ~/.ssh/id_ed25519    # macOS, remembers across reboots

What the place is like

Your home directory has a WELCOME.txt explaining how it all works: where your web page lives, which directories other members can read, and which ones they can't.

One thing worth knowing before you arrive, because the signup asks you to agree to it: this is a shared, open machine, and members can read each other's home directories. That is deliberate — being able to look around at what people are building is most of the point. Anything you want kept to yourself goes in ~/private/. WELCOME.txt has the full list of directories that are protected by default.

Adding a second computer later

Once you are a member, do not apply again. Make a key on the new machine with step 1, then add its public half to ~/.ssh/authorized_keys on the tilde:

cat ~/.ssh/id_ed25519.pub          # on the new machine, copy the line
ssh -p 2222 yourname@kerf.ides.club    # from a machine that already works
echo 'ssh-ed25519 AAAA... you@newlaptop' >> ~/.ssh/authorized_keys

Keys are per-device on purpose. Three keys you can revoke separately beats one private key you copy around.