fix: implement persistent SSH key storage with key generation

- Fix 'error in libcrypto' issue by using persistent key files instead of temporary ones
- Add SSH key pair generation feature with 'Generate Key Pair' button
- Add 'View Public Key' button for generated keys with copy-to-clipboard functionality
- Remove confusing 'both' authentication option, now only supports 'password' OR 'key'
- Add persistent storage in data/ssh-keys/ directory with proper permissions
- Update database schema with ssh_key_path and key_generated columns
- Add API endpoints for key generation and public key retrieval
- Enhance UX by hiding manual key input when key pair is generated
- Update HelpModal documentation to reflect new SSH key features
- Fix all TypeScript compilation errors and linting issues

Resolves SSH authentication failures during script execution

src/server/database.js

@@ -1,5 +1,7 @@
 import Database from 'better-sqlite3';
 import { join } from 'path';
+import { writeFileSync, unlinkSync, chmodSync, mkdirSync } from 'fs';
+import { existsSync } from 'fs';
 
 class DatabaseService {
   constructor() {
@@ -9,6 +11,12 @@ class DatabaseService {
   }
 
   init() {
+    // Ensure data/ssh-keys directory exists
+    const sshKeysDir = join(process.cwd(), 'data', 'ssh-keys');
+    if (!existsSync(sshKeysDir)) {
+      mkdirSync(sshKeysDir, { mode: 0o700 });
+    }
+
     // Create servers table if it doesn't exist
     this.db.exec(`
       CREATE TABLE IF NOT EXISTS servers (
@@ -17,10 +25,12 @@ class DatabaseService {
         ip TEXT NOT NULL,
         user TEXT NOT NULL,
         password TEXT,
-        auth_type TEXT DEFAULT 'password' CHECK(auth_type IN ('password', 'key', 'both')),
+        auth_type TEXT DEFAULT 'password' CHECK(auth_type IN ('password', 'key')),
         ssh_key TEXT,
         ssh_key_passphrase TEXT,
         ssh_port INTEGER DEFAULT 22,
+        ssh_key_path TEXT,
+        key_generated INTEGER DEFAULT 0,
         color TEXT,
         created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
         updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
@@ -30,7 +40,7 @@ class DatabaseService {
     // Migration: Add new columns to existing servers table
     try {
       this.db.exec(`
-        ALTER TABLE servers ADD COLUMN auth_type TEXT DEFAULT 'password' CHECK(auth_type IN ('password', 'key', 'both'))
+        ALTER TABLE servers ADD COLUMN auth_type TEXT DEFAULT 'password' CHECK(auth_type IN ('password', 'key'))
       `);
     } catch (e) {
       // Column already exists, ignore error
@@ -68,6 +78,22 @@ class DatabaseService {
       // Column already exists, ignore error
     }
 
+    try {
+      this.db.exec(`
+        ALTER TABLE servers ADD COLUMN ssh_key_path TEXT
+      `);
+    } catch (e) {
+      // Column already exists, ignore error
+    }
+
+    try {
+      this.db.exec(`
+        ALTER TABLE servers ADD COLUMN key_generated INTEGER DEFAULT 0
+      `);
+    } catch (e) {
+      // Column already exists, ignore error
+    }
+
     // Update existing servers to have auth_type='password' if not set
     this.db.exec(`
       UPDATE servers SET auth_type = 'password' WHERE auth_type IS NULL
@@ -78,6 +104,16 @@ class DatabaseService {
       UPDATE servers SET ssh_port = 22 WHERE ssh_port IS NULL
     `);
 
+    // Migration: Convert 'both' auth_type to 'key'
+    this.db.exec(`
+      UPDATE servers SET auth_type = 'key' WHERE auth_type = 'both'
+    `);
+
+    // Update existing servers to have key_generated=0 if not set
+    this.db.exec(`
+      UPDATE servers SET key_generated = 0 WHERE key_generated IS NULL
+    `);
+
     // Migration: Add web_ui_ip column to existing installed_scripts table
     try {
       this.db.exec(`
@@ -129,12 +165,21 @@ class DatabaseService {
    * @param {import('../types/server').CreateServerData} serverData
    */
   createServer(serverData) {
-    const { name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, color } = serverData;
+    const { name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, color, key_generated } = serverData;
+    
+    let ssh_key_path = null;
+    
+    // If using SSH key authentication, create persistent key file
+    if (auth_type === 'key' && ssh_key) {
+      const serverId = this.getNextServerId();
+      ssh_key_path = this.createSSHKeyFile(serverId, ssh_key);
+    }
+    
     const stmt = this.db.prepare(`
-      INSERT INTO servers (name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, color) 
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      INSERT INTO servers (name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, ssh_key_path, key_generated, color) 
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
     `);
-    return stmt.run(name, ip, user, password, auth_type || 'password', ssh_key, ssh_key_passphrase, ssh_port || 22, color);
+    return stmt.run(name, ip, user, password, auth_type || 'password', ssh_key, ssh_key_passphrase, ssh_port || 22, ssh_key_path, key_generated || 0, color);
   }
 
   getAllServers() {
@@ -155,19 +200,85 @@ class DatabaseService {
    * @param {import('../types/server').CreateServerData} serverData
    */
   updateServer(id, serverData) {
-    const { name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, color } = serverData;
+    const { name, ip, user, password, auth_type, ssh_key, ssh_key_passphrase, ssh_port, color, key_generated } = serverData;
+    
+    // Get existing server to check for key changes
+    const existingServer = this.getServerById(id);
+    // @ts-ignore - Database migration adds this column
+    let ssh_key_path = existingServer?.ssh_key_path;
+    
+    // Handle SSH key changes
+    if (auth_type === 'key' && ssh_key) {
+      // Delete old key file if it exists
+      // @ts-ignore - Database migration adds this column
+      if (existingServer?.ssh_key_path && existsSync(existingServer.ssh_key_path)) {
+        try {
+          // @ts-ignore - Database migration adds this column
+          unlinkSync(existingServer.ssh_key_path);
+          // Also delete public key file if it exists
+          // @ts-ignore - Database migration adds this column
+          const pubKeyPath = existingServer.ssh_key_path + '.pub';
+          if (existsSync(pubKeyPath)) {
+            unlinkSync(pubKeyPath);
+          }
+        } catch (error) {
+          console.warn('Failed to delete old SSH key file:', error);
+        }
+      }
+      
+      // Create new key file
+      ssh_key_path = this.createSSHKeyFile(id, ssh_key);
+    } else if (auth_type !== 'key') {
+      // If switching away from key auth, delete key files
+      // @ts-ignore - Database migration adds this column
+      if (existingServer?.ssh_key_path && existsSync(existingServer.ssh_key_path)) {
+        try {
+          // @ts-ignore - Database migration adds this column
+          unlinkSync(existingServer.ssh_key_path);
+          // @ts-ignore - Database migration adds this column
+          const pubKeyPath = existingServer.ssh_key_path + '.pub';
+          if (existsSync(pubKeyPath)) {
+            unlinkSync(pubKeyPath);
+          }
+        } catch (error) {
+          console.warn('Failed to delete SSH key file:', error);
+        }
+      }
+      ssh_key_path = null;
+    }
+    
     const stmt = this.db.prepare(`
       UPDATE servers 
-      SET name = ?, ip = ?, user = ?, password = ?, auth_type = ?, ssh_key = ?, ssh_key_passphrase = ?, ssh_port = ?, color = ?
+      SET name = ?, ip = ?, user = ?, password = ?, auth_type = ?, ssh_key = ?, ssh_key_passphrase = ?, ssh_port = ?, ssh_key_path = ?, key_generated = ?, color = ?
       WHERE id = ?
     `);
-    return stmt.run(name, ip, user, password, auth_type || 'password', ssh_key, ssh_key_passphrase, ssh_port || 22, color, id);
+    // @ts-ignore - Database migration adds this column
+    return stmt.run(name, ip, user, password, auth_type || 'password', ssh_key, ssh_key_passphrase, ssh_port || 22, ssh_key_path, key_generated !== undefined ? key_generated : (existingServer?.key_generated || 0), color, id);
   }
 
   /**
    * @param {number} id
    */
   deleteServer(id) {
+    // Get server info before deletion to clean up key files
+    const server = this.getServerById(id);
+    
+    // Delete SSH key files if they exist
+    // @ts-ignore - Database migration adds this column
+    if (server?.ssh_key_path && existsSync(server.ssh_key_path)) {
+      try {
+        // @ts-ignore - Database migration adds this column
+        unlinkSync(server.ssh_key_path);
+        // @ts-ignore - Database migration adds this column
+        const pubKeyPath = server.ssh_key_path + '.pub';
+        if (existsSync(pubKeyPath)) {
+          unlinkSync(pubKeyPath);
+        }
+      } catch (error) {
+        console.warn('Failed to delete SSH key file:', error);
+      }
+    }
+    
     const stmt = this.db.prepare('DELETE FROM servers WHERE id = ?');
     return stmt.run(id);
   }
@@ -316,6 +427,35 @@ class DatabaseService {
     return stmt.run(server_id);
   }
 
+  /**
+   * Get the next available server ID for key file naming
+   * @returns {number}
+   */
+  getNextServerId() {
+    const stmt = this.db.prepare('SELECT MAX(id) as maxId FROM servers');
+    const result = stmt.get();
+    // @ts-ignore - SQL query result type
+    return (result?.maxId || 0) + 1;
+  }
+
+  /**
+   * Create SSH key file and return the path
+   * @param {number} serverId 
+   * @param {string} sshKey 
+   * @returns {string}
+   */
+  createSSHKeyFile(serverId, sshKey) {
+    const sshKeysDir = join(process.cwd(), 'data', 'ssh-keys');
+    const keyPath = join(sshKeysDir, `server_${serverId}_key`);
+    
+    // Normalize the key: trim any trailing whitespace and ensure exactly one newline at the end
+    const normalizedKey = sshKey.trimEnd() + '\n';
+    writeFileSync(keyPath, normalizedKey);
+    chmodSync(keyPath, 0o600); // Set proper permissions
+    
+    return keyPath;
+  }
+
   close() {
     this.db.close();
   }

src/server/ssh-execution-service.js

@@ -1,8 +1,6 @@
 import { spawn } from 'child_process';
 import { spawn as ptySpawn } from 'node-pty';
-import { writeFileSync, unlinkSync, chmodSync, mkdtempSync, rmdirSync } from 'fs';
-import { join } from 'path';
-import { tmpdir } from 'os';
+import { existsSync } from 'fs';
 
 
 /**
@@ -11,43 +9,22 @@ import { tmpdir } from 'os';
  * @property {string} user - Username
  * @property {string} [password] - Password (optional)
  * @property {string} name - Server name
- * @property {string} [auth_type] - Authentication type ('password', 'key', 'both')
+ * @property {string} [auth_type] - Authentication type ('password', 'key')
  * @property {string} [ssh_key] - SSH private key content
  * @property {string} [ssh_key_passphrase] - SSH key passphrase
+ * @property {string} [ssh_key_path] - Path to persistent SSH key file
  * @property {number} [ssh_port] - SSH port (default: 22)
  */
 
 class SSHExecutionService {
-  /**
-   * Create a temporary SSH key file for authentication
-   * @param {Server} server - Server configuration
-   * @returns {string} Path to temporary key file
-   */
-  createTempKeyFile(server) {
-    const { ssh_key } = server;
-    if (!ssh_key) {
-      throw new Error('SSH key not provided');
-    }
-    
-    const tempDir = mkdtempSync(join(tmpdir(), 'ssh-key-'));
-    const tempKeyPath = join(tempDir, 'private_key');
-    
-    // Normalize the key: trim any trailing whitespace and ensure exactly one newline at the end
-    const normalizedKey = ssh_key.trimEnd() + '\n';
-    writeFileSync(tempKeyPath, normalizedKey);
-    chmodSync(tempKeyPath, 0o600); // Set proper permissions
-    
-    return tempKeyPath;
-  }
 
   /**
    * Build SSH command arguments based on authentication type
    * @param {Server} server - Server configuration
-   * @param {string|null} [tempKeyPath=null] - Path to temporary key file (if using key auth)
    * @returns {{command: string, args: string[]}} Command and arguments for SSH
    */
-  buildSSHCommand(server, tempKeyPath = null) {
-    const { ip, user, password, auth_type = 'password', ssh_key_passphrase, ssh_port = 22 } = server;
+  buildSSHCommand(server) {
+    const { ip, user, password, auth_type = 'password', ssh_key_passphrase, ssh_key_path, ssh_port = 22 } = server;
     
     const baseArgs = [
       '-t',
@@ -69,12 +46,14 @@ class SSHExecutionService {
 
     if (auth_type === 'key') {
       // SSH key authentication
-      if (tempKeyPath) {
-        baseArgs.push('-i', tempKeyPath);
-        baseArgs.push('-o', 'PasswordAuthentication=no');
-        baseArgs.push('-o', 'PubkeyAuthentication=yes');
+      if (!ssh_key_path || !existsSync(ssh_key_path)) {
+        throw new Error('SSH key file not found');
       }
       
+      baseArgs.push('-i', ssh_key_path);
+      baseArgs.push('-o', 'PasswordAuthentication=no');
+      baseArgs.push('-o', 'PubkeyAuthentication=yes');
+      
       if (ssh_key_passphrase) {
         return {
           command: 'sshpass',
@@ -86,35 +65,6 @@ class SSHExecutionService {
           args: [...baseArgs, `${user}@${ip}`]
         };
       }
-    } else if (auth_type === 'both') {
-      // Try SSH key first, then password
-      if (tempKeyPath) {
-        baseArgs.push('-i', tempKeyPath);
-        baseArgs.push('-o', 'PasswordAuthentication=yes');
-        baseArgs.push('-o', 'PubkeyAuthentication=yes');
-        
-        if (ssh_key_passphrase) {
-          return {
-            command: 'sshpass',
-            args: ['-P', 'passphrase', '-p', ssh_key_passphrase, 'ssh', ...baseArgs, `${user}@${ip}`]
-          };
-        } else {
-          return {
-            command: 'ssh',
-            args: [...baseArgs, `${user}@${ip}`]
-          };
-        }
-      } else {
-        // Fallback to password
-        if (password) {
-          return {
-            command: 'sshpass',
-            args: ['-p', password, 'ssh', ...baseArgs, '-o', 'PasswordAuthentication=yes', '-o', 'PubkeyAuthentication=no', `${user}@${ip}`]
-          };
-        } else {
-          throw new Error('Password is required for password authentication');
-        }
-      }
     } else {
       // Password authentication (default)
       if (password) {
@@ -138,9 +88,6 @@ class SSHExecutionService {
    * @returns {Promise<Object>} Process information
    */
   async executeScript(server, scriptPath, onData, onError, onExit) {
-    /** @type {string|null} */
-    let tempKeyPath = null;
-    
     try {
       await this.transferScriptsFolder(server, onData, onError);
       
@@ -148,13 +95,8 @@ class SSHExecutionService {
         const relativeScriptPath = scriptPath.startsWith('scripts/') ? scriptPath.substring(8) : scriptPath;
         
         try {
-          // Create temporary key file if using key authentication
-          if (server.auth_type === 'key' || server.auth_type === 'both') {
-            tempKeyPath = this.createTempKeyFile(server);
-          }
-          
           // Build SSH command based on authentication type
-          const { command, args } = this.buildSSHCommand(server, tempKeyPath);
+          const { command, args } = this.buildSSHCommand(server);
           
           // Add the script execution command to the args
           args.push(`cd /tmp/scripts && chmod +x ${relativeScriptPath} && export TERM=xterm-256color && export COLUMNS=120 && export LINES=30 && export COLORTERM=truecolor && export FORCE_COLOR=1 && export NO_COLOR=0 && export CLICOLOR=1 && export CLICOLOR_FORCE=1 && bash ${relativeScriptPath}`);
@@ -193,30 +135,10 @@ class SSHExecutionService {
           process: sshCommand,
           kill: () => {
             sshCommand.kill('SIGTERM');
-            // Clean up temporary key file
-            if (tempKeyPath) {
-              try {
-                unlinkSync(tempKeyPath);
-                const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-                rmdirSync(tempDir);
-              } catch (cleanupError) {
-                console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-              }
-            }
           }
         });
         
         } catch (error) {
-          // Clean up temporary key file on error
-          if (tempKeyPath) {
-            try {
-              unlinkSync(tempKeyPath);
-              const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-              rmdirSync(tempDir);
-            } catch (cleanupError) {
-              console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-            }
-          }
           reject(error);
         }
       });
@@ -235,35 +157,24 @@ class SSHExecutionService {
    * @returns {Promise<void>}
    */
   async transferScriptsFolder(server, onData, onError) {
-    const { ip, user, password, auth_type = 'password', ssh_key, ssh_key_passphrase, ssh_port = 22 } = server;
-    /** @type {string|null} */
-    let tempKeyPath = null;
+    const { ip, user, password, auth_type = 'password', ssh_key_passphrase, ssh_key_path, ssh_port = 22 } = server;
     
     return new Promise((resolve, reject) => {
       try {
-        // Create temporary key file if using key authentication
-        if (auth_type === 'key' || auth_type === 'both') {
-          if (ssh_key) {
-            tempKeyPath = this.createTempKeyFile(server);
-          }
-        }
-        
         // Build rsync command based on authentication type
         let rshCommand;
-        if (auth_type === 'key' && tempKeyPath) {
-          if (ssh_key_passphrase) {
-            rshCommand = `sshpass -P passphrase -p ${ssh_key_passphrase} ssh -i ${tempKeyPath} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
-          } else {
-            rshCommand = `ssh -i ${tempKeyPath} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+        if (auth_type === 'key') {
+          if (!ssh_key_path || !existsSync(ssh_key_path)) {
+            throw new Error('SSH key file not found');
           }
-        } else if (auth_type === 'both' && tempKeyPath) {
+          
           if (ssh_key_passphrase) {
-            rshCommand = `sshpass -P passphrase -p ${ssh_key_passphrase} ssh -i ${tempKeyPath} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+            rshCommand = `sshpass -P passphrase -p ${ssh_key_passphrase} ssh -i ${ssh_key_path} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
           } else {
-            rshCommand = `ssh -i ${tempKeyPath} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
+            rshCommand = `ssh -i ${ssh_key_path} -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
           }
         } else {
-          // Fallback to password authentication
+          // Password authentication
           rshCommand = `sshpass -p ${password} ssh -p ${ssh_port} -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null`;
         }
         
@@ -292,17 +203,6 @@ class SSHExecutionService {
       });
 
       rsyncCommand.on('close', (code) => {
-        // Clean up temporary key file
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
-        
         if (code === 0) {
           resolve();
         } else {
@@ -311,30 +211,10 @@ class SSHExecutionService {
       });
 
       rsyncCommand.on('error', (error) => {
-        // Clean up temporary key file on error
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
         reject(error);
       });
       
       } catch (error) {
-        // Clean up temporary key file on error
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
         reject(error);
       }
     });
@@ -350,18 +230,10 @@ class SSHExecutionService {
    * @returns {Promise<Object>} Process information
    */
   async executeCommand(server, command, onData, onError, onExit) {
-    /** @type {string|null} */
-    let tempKeyPath = null;
-    
     return new Promise((resolve, reject) => {
       try {
-        // Create temporary key file if using key authentication
-        if (server.auth_type === 'key' || server.auth_type === 'both') {
-          tempKeyPath = this.createTempKeyFile(server);
-        }
-        
         // Build SSH command based on authentication type
-        const { command: sshCommandName, args } = this.buildSSHCommand(server, tempKeyPath);
+        const { command: sshCommandName, args } = this.buildSSHCommand(server);
         
         // Add the command to execute to the args
         args.push(command);
@@ -380,16 +252,6 @@ class SSHExecutionService {
       });
 
       sshCommand.onExit((e) => {
-        // Clean up temporary key file
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
         onExit(e.exitCode);
       });
 
@@ -397,30 +259,10 @@ class SSHExecutionService {
         process: sshCommand,
         kill: () => {
           sshCommand.kill('SIGTERM');
-          // Clean up temporary key file
-          if (tempKeyPath) {
-            try {
-              unlinkSync(tempKeyPath);
-              const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-              rmdirSync(tempDir);
-            } catch (cleanupError) {
-              console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-            }
-          }
         }
       });
       
       } catch (error) {
-        // Clean up temporary key file on error
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
         reject(error);
       }
     });

src/server/ssh-service.js

@@ -1,5 +1,5 @@
 import { spawn } from 'child_process';
-import { writeFileSync, unlinkSync, chmodSync, mkdtempSync, rmdirSync } from 'fs';
+import { writeFileSync, unlinkSync, chmodSync, mkdtempSync, rmdirSync, readFileSync, existsSync } from 'fs';
 import { join } from 'path';
 import { tmpdir } from 'os';
 
@@ -21,9 +21,6 @@ class SSHService {
       let authPromise;
       if (auth_type === 'key') {
         authPromise = this.testWithSSHKey(server);
-      } else if (auth_type === 'both') {
-        // Try SSH key first, then password
-        authPromise = this.testWithSSHKey(server).catch(() => this.testWithSshpass(server));
       } else {
         // Default to password authentication
         authPromise = this.testWithSshpass(server).catch(() => this.testWithExpect(server));
@@ -540,31 +537,20 @@ expect {
    * @returns {Promise<Object>} Connection test result
    */
   async testWithSSHKey(server) {
-    const { ip, user, ssh_key, ssh_key_passphrase, ssh_port = 22 } = server;
+    const { ip, user, ssh_key_path, ssh_key_passphrase, ssh_port = 22 } = server;
     
-    if (!ssh_key) {
-      throw new Error('SSH key not provided');
+    if (!ssh_key_path || !existsSync(ssh_key_path)) {
+      throw new Error('SSH key file not found');
     }
 
     return new Promise((resolve, reject) => {
       const timeout = 10000;
       let resolved = false;
-      let tempKeyPath = null;
       
       try {
-        // Create temporary key file
-        const tempDir = mkdtempSync(join(tmpdir(), 'ssh-key-'));
-        tempKeyPath = join(tempDir, 'private_key');
-        
-        // Write the private key to temporary file
-        // Normalize the key: trim any trailing whitespace and ensure exactly one newline at the end
-        const normalizedKey = ssh_key.trimEnd() + '\n';
-        writeFileSync(tempKeyPath, normalizedKey);
-        chmodSync(tempKeyPath, 0o600); // Set proper permissions
-        
         // Build SSH command
         const sshArgs = [
-          '-i', tempKeyPath,
+          '-i', ssh_key_path,
           '-p', ssh_port.toString(),
           '-o', 'ConnectTimeout=10',
           '-o', 'StrictHostKeyChecking=no',
@@ -662,22 +648,82 @@ expect {
           resolved = true;
           reject(error);
         }
-      } finally {
-        // Clean up temporary key file
-        if (tempKeyPath) {
-          try {
-            unlinkSync(tempKeyPath);
-            // Also remove the temp directory
-            const tempDir = tempKeyPath.substring(0, tempKeyPath.lastIndexOf('/'));
-            rmdirSync(tempDir);
-          } catch (cleanupError) {
-            console.warn('Failed to clean up temporary SSH key file:', cleanupError);
-          }
-        }
       }
     });
   }
 
+  /**
+   * Generate SSH key pair for a server
+   * @param {number} serverId - Server ID for key file naming
+   * @returns {Promise<{privateKey: string, publicKey: string}>}
+   */
+  async generateKeyPair(serverId) {
+    const sshKeysDir = join(process.cwd(), 'data', 'ssh-keys');
+    const keyPath = join(sshKeysDir, `server_${serverId}_key`);
+    
+    return new Promise((resolve, reject) => {
+      const sshKeygen = spawn('ssh-keygen', [
+        '-t', 'ed25519',
+        '-f', keyPath,
+        '-N', '', // No passphrase
+        '-C', 'pve-scripts-local'
+      ], {
+        stdio: ['pipe', 'pipe', 'pipe']
+      });
+
+      let errorOutput = '';
+      
+      sshKeygen.stderr.on('data', (data) => {
+        errorOutput += data.toString();
+      });
+
+      sshKeygen.on('close', (code) => {
+        if (code === 0) {
+          try {
+            // Read the generated private key
+            const privateKey = readFileSync(keyPath, 'utf8');
+            
+            // Read the generated public key
+            const publicKeyPath = keyPath + '.pub';
+            const publicKey = readFileSync(publicKeyPath, 'utf8');
+            
+            // Set proper permissions
+            chmodSync(keyPath, 0o600);
+            chmodSync(publicKeyPath, 0o644);
+            
+            resolve({
+              privateKey,
+              publicKey: publicKey.trim()
+            });
+          } catch (error) {
+            reject(new Error(`Failed to read generated key files: ${error instanceof Error ? error.message : String(error)}`));
+          }
+        } else {
+          reject(new Error(`ssh-keygen failed: ${errorOutput}`));
+        }
+      });
+
+      sshKeygen.on('error', (error) => {
+        reject(new Error(`Failed to run ssh-keygen: ${error.message}`));
+      });
+    });
+  }
+
+  /**
+   * Get public key from private key file
+   * @param {string} keyPath - Path to private key file
+   * @returns {string} Public key content
+   */
+  getPublicKey(keyPath) {
+    const publicKeyPath = keyPath + '.pub';
+    
+    if (!existsSync(publicKeyPath)) {
+      throw new Error('Public key file not found');
+    }
+    
+    return readFileSync(publicKeyPath, 'utf8').trim();
+  }
+
 }
 
 // Singleton instance