API
Get an API keyTry it

Switch on rescue system of a virtual server

Boot one vServer into the rescue system at its next restart, with root's keys or password.

WWriteNot idempotentbetaNeeds service_vserver
Tool
manitu_vserver_rescuesystem_enableon https://mcp.manitu.de/mcp
POST
/v1/vserver/rescuesystem/enableon https://api.manitu.de
Try it
Changes the account. Agents say what will happen and wait for an explicit yes before calling it.

Annotations as tools/list sends them

readOnlyHint falsedestructiveHint falseidempotentHint falseopenWorldHint false

Description for the model

Switches on the rescue system of a virtual server (vServer), by its vserver_id from manitu_vserver_list: a minimal Linux (grml) the server boots into instead of its own disk - to repair a system that no longer starts. It takes effect at the NEXT RESTART only: restart the server afterwards with manitu_vserver_power_reboot (ask the customer first), then root logs in via SSH on the server's IP address; the rescue system has an SSH host key of its own, so the client warns about a changed key - expected. Give root_ssh_key_list - the customer's public key(s), the way to prefer - or root_password_hash. NEVER ask for or pass a plaintext password: root_password is refused over this connection, a password in a chat is no longer secret - for a password, the customer uses the customer panel. Calling it again while the rescue system is on sets new credentials for the next boot into it. Switch it off with manitu_vserver_rescuesystem_disable when done, or the server keeps booting into it. Ask the customer for an explicit yes first: it opens root access to the server. Runs in the background: the answer is the workflow started (see pending_workflow_list of manitu_vserver_get for its progress, rescue_system_enabled there for the state). Refused with a conflict while another workflow runs on the vServer (blocked_by names it - wait for it, do not retry at once) or while it cannot be changed.

Provide at least one of: root_ssh_key_list, root_password, root_password_hash.

Arguments

vserver_idinteger | stringrequired

The vserver_id from manitu_vserver_list - never guess one.

pattern ^[1-9][0-9]*$min 1
root_ssh_key_listarray of string

Public SSH keys that may log in as root in the rescue system - the way to prefer. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key.

min items 1max items 20
root_passwordstringwrite-only

The root password in the rescue system - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Not together with root_password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com).

min length 12max length 72pattern ^[\x20-\x7E]+$
root_password_hashstringwrite-only

The root password in the rescue system as a crypt hash made by the customer - instead of root_password. A hash can be attacked offline: only for a strong password. Taken: SHA-512 crypt ("$6$...", e.g. from "openssl passwd -6" or "mkpasswd -m sha-512") or bcrypt ("$2b$" or "$2y$", cost 10 or more).

max length 128pattern ^\$
The tool list carries this simplified form: a rule at the root of a schema does not reach every client, so it is said in the description instead.

Result structuredContent, checked against the schema

workflowstringrequired

What is being done, e.g. a reboot.

One of create destroy power_start power_stop power_reboot reinstall ptr_set vnc_enable vnc_disable rescuesystem_enable rescuesystem_disable snapshot_create snapshot_delete snapshot_delete_all snapshot_revert telemetry_await iso_eject
workflow_idstringrequired

The id of this run of the workflow.

created_atstring | nullrequired

When it was asked for.

Format date-time
started_atstring | nullrequired

When it started; null while it waits for the next run - usually a minute or two, at times longer. Nothing to tell the customer unless asked.

Format date-time
workflow_tokenstring | nullrequired

Pass it to manitu_workflow_get to see how far the workflow is - as it is, never built or changed. A secret of this workflow: do not show it to anyone. null if there is none.

taskobjectrequired

The task the customer panel polls for its progress.

task.idintegerrequired
task.authstringrequired

Authentication

One of X-API-Key, Authorization: Bearer … - never more than one in a request. More

Request body JSON; unknown fields are refused

Provide at least one of: root_ssh_key_list, root_password, root_password_hash.
vserver_idinteger | stringrequired

The vserver_id from manitu_vserver_list - never guess one.

pattern ^[1-9][0-9]*$min 1
root_ssh_key_listarray of string

Public SSH keys that may log in as root in the rescue system - the way to prefer. Each one public key, one line as in authorized_keys: "ssh-ed25519 AAAA... comment" (also ecdsa-sha2-nistp256/384/521, ssh-rsa from 2048 bits). No options in front of the key (command=, environment=, from= ...), no DSA. The public key only - never a private key.

min items 1max items 20
root_passwordstringwrite-only

The root password in the rescue system - customer panel and REST only, refused over MCP: never ask for a password in a chat. Kept as a hash only, never shown again. Not together with root_password_hash. 12 to 72 printable ASCII characters, no space at the start or the end, not listed as leaked (pwnedpasswords.com).

min length 12max length 72pattern ^[\x20-\x7E]+$
root_password_hashstringwrite-only

The root password in the rescue system as a crypt hash made by the customer - instead of root_password. A hash can be attacked offline: only for a strong password. Taken: SHA-512 crypt ("$6$...", e.g. from "openssl passwd -6" or "mkpasswd -m sha-512") or bcrypt ("$2b$" or "$2y$", cost 10 or more).

max length 128pattern ^\$

Response in data; the rest of the body as on every call

workflowstringrequired

What is being done, e.g. a reboot.

One of create destroy power_start power_stop power_reboot reinstall ptr_set vnc_enable vnc_disable rescuesystem_enable rescuesystem_disable snapshot_create snapshot_delete snapshot_delete_all snapshot_revert telemetry_await iso_eject
workflow_idstringrequired

The id of this run of the workflow.

created_atstring | nullrequired

When it was asked for.

Format date-time
started_atstring | nullrequired

When it started; null while it waits for the next run - usually a minute or two, at times longer. Nothing to tell the customer unless asked.

Format date-time
workflow_tokenstring | nullrequired

Pass it to manitu_workflow_get to see how far the workflow is - as it is, never built or changed. A secret of this workflow: do not show it to anyone. null if there is none.

taskobjectrequired

The task the customer panel polls for its progress.

task.idintegerrequired
task.authstringrequired

Statuses

200Success.400The request does not match the declared input schema.401No credential was presented, or it was not recognised.403The credential is not permitted to use this operation.500The server failed. Nothing about the request was wrong. Whether a change took effect is not known - check before trying it again.503The channel this operation forwards through is unavailable.