New ssh pubkey & redesign 'hey push'
Remote rebuilding requires root access, but I don't want root ssh access (even by ssh key) to be a permanent fixture of my servers. So I've changed 'hey push' to copy my remote user's `authorized_keys` to /root/.ssh/ temporarily, until the rebuild is complete. It is removed afterwards. This should be done non-destructively in the future, but it suits my needs for now.
This commit is contained in:
		
							parent
							
								
									69d730f89d
								
							
						
					
					
						commit
						e703bd374d
					
				
							
								
								
									
										15
									
								
								bin/hey
									
									
									
									
									
								
							
							
						
						
									
										15
									
								
								bin/hey
									
									
									
									
									
								
							|  | @ -149,8 +149,19 @@ function main { | |||
|     swap)        _swap $@                       ;; | ||||
|     gc)          _gc "$@"                       ;; | ||||
|     push) | ||||
|       rsync -avzh ./ "$1:$REMOTE/" | ||||
|       ssh -t -l "$USERNAME" "$1" "$REMOTE/bin/hey re" "${@[2,-1]}" | ||||
|       target=$1 | ||||
|       cmd=${2:-test} | ||||
|       # build then ssh in to switch/boot/test so we don't require root ssh | ||||
|       # access on the remote. | ||||
|       echo "Enabling root ssh access on $target" | ||||
|       ssh -t "$target" "sudo mkdir -p /root/.ssh && sudo cp -f ~/.ssh/authorized_keys /root/.ssh/" | ||||
|       echo "Building $target ($cmd)" | ||||
|       HOSTNAME="${HOSTNAME:-$target}" _rebuild \ | ||||
|         --build-host localhost \ | ||||
|         --target-host "root@$target" \ | ||||
|         $cmd | ||||
|       echo "Undoing root ssh access on $target" | ||||
|       ssh -t "root@$target" "rm -f /root/.ssh/authorized_keys" | ||||
|       ;; | ||||
| 
 | ||||
|     gen|generations) | ||||
|  |  | |||
|  | @ -15,8 +15,9 @@ in { | |||
|       passwordAuthentication = false; | ||||
|     }; | ||||
| 
 | ||||
|     user.openssh.authorizedKeys.keys = [ | ||||
|       "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8Tl2pj6CPBV3V72cohPhn+k0a/Na3cOrbmUtFC7rR7icWocSs1S1cSrP3sPLwUqRh3+zfIuLXTrTv3gj8Xvg8WELOspzsiYeAtbcHrnWnx/a7xzYvFyT9/8hkiGM/F6w7IuKEk+AZW34vARSgRPJ1FdH8NbPKJ8ay9zW9XB9YJGnbzIRmsVVpQ8l6Fh8ZqRjZfC1ea7hns8+HgjPrIHFb+S3qZZiwU4Gc8aWJy9ziwwkllEsSchv3aigYA3eOeW0FUQFiKsLGxbX2b2b3d6jFO4Pu+dMSen0h5IzBo0nh7UADSfJPdwbZaMuJzviKe2y6zg6jaM9XRIhLBT6bftDr henrik@lissner.net" | ||||
|     ]; | ||||
|     user.openssh.authorizedKeys.keys = | ||||
|       if config.user.name == "hlissner" | ||||
|       then [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB71rSnjuC06Qq3NLXQJwSz7jazoB+umydddrxL6vg1a henrik@lissner.net" ] | ||||
|       else []; | ||||
|   }; | ||||
| } | ||||
|  |  | |||
		Loading…
	
		Reference in a new issue