Skip to content

Pin the nodes' SSH host keys so CI can verify them #318

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We鈥檒l occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
anuveyatsu merged 1 commit into from
Sep 13, 2026
Merged

Pin the nodes' SSH host keys so CI can verify them #318

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion infra/ansible/ansible.cfg
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,4 +61,4 @@ retries = 3
# traffic on the channel, and a silently dropped session is reported as a lost
# host rather than a timeout. CountMax=6 gives up after three minutes, so a
# genuinely dead connection is detected rather than hung on.
ssh_args = -o ProxyCommand="cloudflared access ssh --hostname %h" -o ControlMaster=auto -o ControlPersist=300s -o Compression=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=6
ssh_args = -o ProxyCommand="cloudflared access ssh --hostname %h" -o UserKnownHostsFile=known_hosts -o StrictHostKeyChecking=yes -o ControlMaster=auto -o ControlPersist=300s -o Compression=yes -o ServerAliveInterval=30 -o ServerAliveCountMax=6
13 changes: 13 additions & 0 deletions infra/ansible/known_hosts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
# Pinned SSH host keys for the nodes, reached at their Cloudflare hostnames.
#
# host_key_checking is on (ansible.cfg), and a fresh CI runner has no cached
# keys, so the first CI deploy failed with "Host key verification failed".
# Rather than turn checking off, the keys are pinned here and verified against
# -- by CI and by every laptop, so verification no longer depends on whoever
# happened to accept the key first.
#
# These are PUBLIC keys; committing them is safe and is the point. If a node is
# reprovisioned its host key changes and the deploy fails loudly here until
# this file is updated (fetch /etc/ssh/ssh_host_ed25519_key.pub from the node).
ssh-staging.openbases.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIcVIXO7Wzd+sIdcrIUTI0huAq3rRZirc7Umuztmyh8U
ssh-exec-staging.openbases.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOWqJpxd18JhrYb6I/XlriG+M1OG2ZdkFFecZn84DSW5
Loading