aynish/helm
1
0
Fork 0
Code Pull requests Packages Projects Releases Activity

New ssh pubkey & redesign 'hey push'

Browse source 
Remote rebuilding requires root access, but I don't want root ssh
access (even by ssh key) to be a permanent fixture of my servers.  So
I've changed 'hey push' to copy my remote user's `authorized_keys` to
/root/.ssh/ temporarily, until the rebuild is complete. It is removed
afterwards.

This should be done non-destructively in the future, but it suits my
needs for now.
This commit is contained in:
Henrik Lissner 2021-01-20 01:30:43 -05:00
parent 69d730f89d
commit e703bd374d
2 changed files with 17 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
bin/hey
View file

@ -149,8 +149,19 @@ function main {
swap) _swap $@ ;; swap) _swap $@ ;;
gc) _gc "$@" ;; gc) _gc "$@" ;;
push) push)
rsync -avzh ./ "$1:$REMOTE/" target=$1
ssh -t -l "$USERNAME" "$1" "$REMOTE/bin/hey re" "${@[2,-1]}" cmd=${2:-test}
# build then ssh in to switch/boot/test so we don't require root ssh
# access on the remote.
echo "Enabling root ssh access on $target"
ssh -t "$target" "sudo mkdir -p /root/.ssh && sudo cp -f ~/.ssh/authorized_keys /root/.ssh/"
echo "Building $target ($cmd)"
HOSTNAME="${HOSTNAME:-$target}" _rebuild \
--build-host localhost \
--target-host "root@$target" \
$cmd
echo "Undoing root ssh access on $target"
ssh -t "root@$target" "rm -f /root/.ssh/authorized_keys"
;; ;;
gen|generations) gen|generations)

7
modules/services/ssh.nix
View file

@ -15,8 +15,9 @@ in {
passwordAuthentication = false; passwordAuthentication = false;
}; };
user.openssh.authorizedKeys.keys = [ user.openssh.authorizedKeys.keys =
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC8Tl2pj6CPBV3V72cohPhn+k0a/Na3cOrbmUtFC7rR7icWocSs1S1cSrP3sPLwUqRh3+zfIuLXTrTv3gj8Xvg8WELOspzsiYeAtbcHrnWnx/a7xzYvFyT9/8hkiGM/F6w7IuKEk+AZW34vARSgRPJ1FdH8NbPKJ8ay9zW9XB9YJGnbzIRmsVVpQ8l6Fh8ZqRjZfC1ea7hns8+HgjPrIHFb+S3qZZiwU4Gc8aWJy9ziwwkllEsSchv3aigYA3eOeW0FUQFiKsLGxbX2b2b3d6jFO4Pu+dMSen0h5IzBo0nh7UADSfJPdwbZaMuJzviKe2y6zg6jaM9XRIhLBT6bftDr henrik@lissner.net" if config.user.name == "hlissner"
]; then [ "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB71rSnjuC06Qq3NLXQJwSz7jazoB+umydddrxL6vg1a henrik@lissner.net" ]
else [];
}; };
} }