Support encrypted SSH private key passphrases

[Copilot]

The SSH service accepted either a password or a key file, but it did not support encrypted private keys. That blocked valid SSH auth flows when a key was protected by a passphrase.

• Key changes
  • Added an optional passphrase field to the ssh_command.execute service and documented it alongside key_file.
  • Enforced validation: passphrase is only accepted when key_file is provided, preventing invalid combinations.
  • Passed the value through to asyncssh.connect(...) so encrypted private keys can be decrypted during authentication.

service: ssh_command.execute
data:
  host: example.com
  username: deploy
  key_file: /config/ssh/id_ed25519
  passphrase: !secret ssh_key_passphrase
  command: "uptime"

• Compatibility and docs
  • Updated the README and service metadata so the new parameter is exposed in the integration documentation and UI schema.

• Fixes Handling Private Key Passphrases #43

[Copilot]

🟢 Approval recommended

The functional changes are small, validated end-to-end via updated schema/validation, and covered by new unit tests for both forwarding and error handling.

Pull request overview

Adds support for encrypted SSH private keys by introducing an optional passphrase service parameter, validating its usage, and forwarding it into the AsyncSSH connection flow so passphrase-protected keys can be decrypted during authentication.

Changes:

• Added passphrase to the ssh_command.execute service schema, validation rules, and connection kwargs.
• Added user-facing strings/translations and updated README/service metadata to expose the new field.
• Extended unit tests to cover validation and AsyncSSH error handling/forwarding for passphrases.

File summaries

File	Description
translations/en.json	Adds service-field label/description and new validation/error translation keys for passphrase support.
translations/de.json	Adds German translations for the new passphrase field and related validation/error messages.
strings.json	Updates base integration strings with the new passphrase field and error/validation messages.
services.yaml	Exposes passphrase in service UI schema (and marks secrets as password-type text fields).
README.md	Documents the new passphrase parameter and its validation rule.
const.py	Introduces CONF_PASSPHRASE constant.
init.py	Extends service validation and voluptuous schema to accept/validate passphrase.
coordinator.py	Forwards passphrase into asyncssh.connect(...) and maps KeyEncryptionError to a translated validation error.
tests/unit_tests/test_validate_service_data.py	Adds validation tests for passphrase/key_file combinations.
tests/unit_tests/test_async_execute.py	Adds tests for invalid passphrase handling and forwarding passphrase to connect.

Review details

• Files reviewed: 10/10 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.