Use Scoped Private Sessions for Network-Lab Device Access¶
Status¶
Accepted: Device automation and web management use a foreground, environment- scoped access session rather than public device addresses or persistent global routes.
Context¶
Device access must remain bound to the selected environment through host replacement. Publishing management addresses expands the external boundary, while static global SSH trust cannot distinguish a reconstructed device that reuses an address with a new host key.
Decision¶
The blueprint declares the management network and gateway path. An automation access session discovers platform leases and combines them with operator-defined targets. It emits scoped SSH, inventory, proxy, and client configuration.
Device SSH trust is bound to the environment access state. Web services are forwarded to loopback-only local ports. Several declared web services can share one managed session. The foreground process owns the temporary tunnel or local access path.
Consequences¶
Positive¶
- Lab devices require no public management addresses.
- Rebuilds can reuse private addresses without inheriting stale global host trust.
- SSH, browser, and automation clients resolve one environment target model.
Negative¶
- The access process must remain active while clients use it.
- Device credentials and service metadata still require operator maintenance.
- Reachability and authentication failures must be diagnosed separately.
Alternatives considered¶
- Publish device management ports: rejected because it expands the external attack surface and couples labs to perimeter policy.
- Require manual proxy commands for each tool: rejected because repeated local setup drifts and is difficult to support.