# ProxKey

> Self-hosted SSH key manager for Proxmox — distributes public keys to LXC containers and QEMU VMs via the Proxmox API and pct/qm guest exec, with zero prior SSH access to the guest. Create a container, SSH in immediately.

URL: https://harshith.in/projects/proxkey/
Author: Harshith Sunku (Staff Engineer) — https://harshith.in/about/
Source: https://github.com/harshithsunku/proxkey
Live: https://harshithsunku.github.io/proxkey/
Stack: Python, FastAPI, React, Proxmox, Docker

The bootstrap problem with fresh containers: you can't SSH in to install your key
because your key isn't there yet. ProxKey sidesteps SSH entirely — it talks to the
Proxmox API, discovers every LXC and VM on the node, and executes inside the guest via
`pct exec` (LXC) or `qm guest exec` (QEMU) to write the right keys to the right
`authorized_keys`. Injection scripts are base64-encoded before being piped so shell
quoting survives the SSH → `pct exec` → bash gauntlet, and the script `grep -qF`s
before appending, so re-deploys are idempotent.

Around that core: a key library with per-host or global assignment, clean revocation
through the same execution path, an inspect mode that reads deployed keys without
touching the guest manually, a hookscript endpoint so new containers auto-receive keys
the moment they start, and a full audit log of every injection and revocation.

The stack is a two-container Compose deploy: FastAPI backend with single-file SQLite
state (SQLModel), and an nginx-served React 19 frontend (Vite, Tailwind, TanStack
Query) with dashboard, host, key, and audit views.