feat(ssh): add GIT_SSH_CONFIG to configure a custom ssh config

.env.template

@@ -6,6 +6,7 @@
 # CONTAINER_REGISTRY=mintsystem/
 ODOO_REVISION=18.0.20250725
 # GIT_SSH_PUBLIC_KEY="ssh-ed25519 BBBBC3NzaC1lZDI1NTE5BBBBIDR9Ibi0mATjCyx1EYg594oFkY0rghtgo+pnFHOvAcym Mint-System-Project-MCC@github.com"
+# GIT_SSH_CONFIG="Host github.com\n  Hostname ssh.github.com\n  Port 443\n  User git"
 # GIT_SSH_PRIVATE_KEY="LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLQpiM0JsYm5OemFDMXJaWGt0ZGpFQUFBQUFCRzV2Ym1VQUFBQUVibTl1WlFBQUFBQUFBQUFCQUFBQU13QUFBQXR6YzJndFpXClF5TlRVeE9RQUFBQ0EwZlNHNHRKZ0U0d3NzZFJHSU9mZUtCWkdOSzRJYllLUHFaeFJ6cndITXBnQUFBS2k1WkJhRnVXUVcKaFFBQUFBdHpjMmd0WldReU5UVXhPUUFBQUNBMGZTRzR0SmdFNHdzc2RSR0lPZmVLQlpTks0SWJZS1BxWnhSenJ3SE1wZwowQkFnTT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg=="
 # GITHUB_USERNAME=bot-mintsys
 # GITHUB_PERSONAL_ACCESS_TOKEN=

compose.yml.template

@@ -41,6 +41,7 @@ services:
       ODOO_MAIL_PASSWORD: ${ODOO_MAIL_PASSWORD}
       GIT_SSH_PUBLIC_KEY: ${GIT_SSH_PUBLIC_KEY}
       GIT_SSH_PRIVATE_KEY: ${GIT_SSH_PRIVATE_KEY}
+      GIT_SSH_CONFIG: ${GIT_SSH_CONFIG}
       GITHUB_USERNAME: ${GITHUB_USERNAME}
       GITHUB_PERSONAL_ACCESS_TOKEN: ${GITHUB_PERSONAL_ACCESS_TOKEN}
       ADDONS_GIT_REPOS: ${ADDONS_GIT_REPOS}

images/odoo/CHANGELOG.md

@@ -6,10 +6,12 @@ All notable changes to this project will be documented in this file. The format
 
 ### Added
 
+- `GIT_SSH_CONFIG` env var to write a custom `~/.ssh/config`, so git hosts can be reached on a port other than `22`.
 - Added deprecation message to `download-git-archive`
 
 ### Changed
 
+- `download-odoo-enterprise` and `clone-git-addons` now resolve the effective hostname and port with `ssh -G` before running `ssh-keyscan`, so `known_hosts` matches a host rewritten by `GIT_SSH_CONFIG`. `clone-git-addons` no longer scans for the removed `dsa` key type.
 - Renamed `download-git-archive` to `download-odoo-enterprise`.
 - Modified `entrypoint.sh` to skip `wait-for-pg` if the database hostname cannot be resolved, logging a warning instead.
 - Removed explicit `wait-for-pg` calls from `odoo`, `odoo-nginx`, and default command paths in `entrypoint.sh` as the check is now handled conditionally.

images/odoo/README.md

@@ -119,6 +119,11 @@ services:
       GIT_SSH_PUBLIC_KEY: "ssh-ed25519 BBBBC3NzaC1lZDI1NTE5BBBBIDR9Ibi0mATjCyx1EYg594oFkY0rghtgo+pnFHOvAcym Mint-System-Project-MCC@github.com"
       GIT_SSH_PRIVATE_KEY: "LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLQpiM0JsYm5OemFDMXJaWGt0ZGpFQUFBQUFCRzV2Ym1VQUFBQUVibTl1WlFBQUFBQUFBQUFCQUFBQU13QUFBQXR6YzJndFpXClF5TlRVeE9RQUFBQ0EwZlNHNHRKZ0U0d3NzZFJHSU9mZUtCWkdOSzRJYllLUHFaeFJ6cndITXBnQUFBS2k1WkJhRnVXUVcKaFFBQUFBdHpjMmd0WldReU5UVXhPUUFBQUNBMGZTRzR0SmdFNHdzc2RSR0lPZmVLQlpTks0SWJZS1BxWnhSenJ3SE1wZwowQkFnTT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg=="
       SSH_ID_ALGORITHM: id_ed25519
+      GIT_SSH_CONFIG: |
+        Host github.com
+          Hostname ssh.github.com
+          Port 443
+          User git
       GITHUB_USERNAME: bot-mintsys
       GITHUB_PAT: *****
       GITLAB_URL: https://gitlab.com
@@ -396,6 +401,7 @@ The image can clone git repositories.
 - `GIT_SSH_PUBLIC_KEY`: Public key for SSH connection.
 - `GIT_SSH_PRIVATE_KEY`: Base64 encoded private key for SSH connection: `cat ~/.ssh/id_ed2551 | base64 -w0`
 - `SSH_ID_ALGORITHM`: Filename and algorithm of the SSH key file. Default is `id_ed25519`
+- `GIT_SSH_CONFIG`: Content of the `~/.ssh/config` file. Use it when the default SSH port `22` is blocked on the network.
 - `GITHUB_USERNAME` GitHub username for https git clone and archive download.
 - `GITHUB_PAT`: GitHub access token for https git clone and archive download.
 - `GITLAB_URL`: Url of GitLab instance. Default is `https://gitlab.com`.
@@ -417,6 +423,24 @@ ADDONS_GIT_REPOS=https://github.com/OCA/server-tools#18.0,https://github.com/Min
 
 If you use a git url, make sure a valid SSH private/public key is defined. Branch name fallback is the Odoo version.
 
+Many networks block outgoing connections on port `22`. Set `GIT_SSH_CONFIG` to reach GitHub over port `443` instead:
+
+```yaml
+GIT_SSH_CONFIG: |
+  Host github.com
+    Hostname ssh.github.com
+    Port 443
+    User git
+```
+
+In an `.env` file, write the same config with escaped line breaks:
+
+```bash
+GIT_SSH_CONFIG="Host github.com\n  Hostname ssh.github.com\n  Port 443\n  User git"
+```
+
+The host key is scanned for the hostname and port the config resolves to, so `known_hosts` matches the rewritten host.
+
 ### Addons Path
 
 The entrypoint script searches for module folders in the addons path and creates a new addons path.

images/odoo/bin/add-ssh-key

@@ -4,6 +4,12 @@ set -e
 mkdir -p "$HOME/.ssh"
 chmod 700 "$HOME/.ssh"
 
+if [[ -n "$GIT_SSH_CONFIG" ]]; then
+    log-entrypoint 'Add SSH config from env var.'
+    echo -e "$GIT_SSH_CONFIG" > "$HOME/.ssh/config"
+    chmod 600 "$HOME/.ssh/config"
+fi
+
 if [[ -n "$GIT_SSH_PRIVATE_KEY" ]]; then
     key_filename="${SSH_ID_ALGORITHM:=id_ed25519}"
     log-entrypoint 'Add SSH key from env var.'

images/odoo/bin/clone-git-addons

@@ -47,7 +47,10 @@ if [[ -n "$ADDONS_GIT_REPOS" ]]; then
             git_branch="$ODOO_VERSION"
         fi
 
-        ssh-keyscan -t rsa,dsa "$git_hostname" > "$HOME/.ssh/known_hosts" 2>/dev/null
+        ssh_host_config=$(ssh -F "$HOME/.ssh/config" -G "$git_hostname" 2>/dev/null)
+        ssh_hostname=$(echo "$ssh_host_config" | sed -n 's/^hostname //p')
+        ssh_port=$(echo "$ssh_host_config" | sed -n 's/^port //p')
+        ssh-keyscan -t rsa,ed25519 -p "${ssh_port:-22}" "${ssh_hostname:-$git_hostname}" > "$HOME/.ssh/known_hosts" 2>/dev/null
 
         if [[ ! -d "$git_local_path/.git" ]]; then
 

images/odoo/bin/download-odoo-enterprise

@@ -33,7 +33,10 @@ if [[ -z "$last_ref" ]] || [[ "$last_ref" != "$ODOO_ENTERPRISE_REF" ]]; then
     elif [[ "$git_proto" = "ssh://" ]]; then
 
         add-ssh-key
-        ssh-keyscan -t rsa,ed25519 "$git_hostname" >> "$HOME/.ssh/known_hosts" 2>/dev/null
+        ssh_host_config=$(ssh -F "$HOME/.ssh/config" -G "$git_hostname" 2>/dev/null)
+        ssh_hostname=$(echo "$ssh_host_config" | sed -n 's/^hostname //p')
+        ssh_port=$(echo "$ssh_host_config" | sed -n 's/^port //p')
+        ssh-keyscan -t rsa,ed25519 -p "${ssh_port:-22}" "${ssh_hostname:-$git_hostname}" >> "$HOME/.ssh/known_hosts" 2>/dev/null
         rm -f "$ref_file"
 
         if [[ ! -d "$odoo_enterprise_path/.git" ]]; then

images/odoo/bin/remove-ssh-key

@@ -10,4 +10,9 @@ if [[ -n "$GIT_SSH_PRIVATE_KEY" ]]; then
         fi
     fi
     rm -f "$HOME/.ssh/$key_filename"
-fi
+fi
+
+if [[ -n "$GIT_SSH_CONFIG" ]]; then
+    log-entrypoint 'Remove SSH config from env var.'
+    rm -f "$HOME/.ssh/config"
+fi