Give CI an SSH key the nodes authorise - #319
Merged
Merged
Conversation
The CI deploy got through the tunnel, Access and host-key verification and then failed at the SSH layer: "Permission denied (publickey)". The nodes authorise one key -- the operator's, injected by Hetzner at provision -- and CI has no laptop and no such key. The ssh role now installs a dedicated CI deploy key into root's authorized_keys, appended so the operator's injected key is untouched, and gated on ci_deploy_ssh_public_key (defaulted to the committed public half). A separate key means CI can be revoked by deleting the line and redeploying, without disturbing anyone's laptop access. The public key is committed; the private half is the GitHub Actions secret WG_CI_SSH_KEY, and deploy.yml writes it to a 0600 file and points ANSIBLE_PRIVATE_KEY_FILE at it. The auth guard now refuses to start without it. The key is already installed on both staging nodes (ansible lineinfile, CHANGED on both); the role task keeps it there idempotently on every run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 45 minutes. View limit detailsLimit details: You’ve used the included review currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Advanced Run ID: 📒 Files selected for processing (3)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Third and last auth gate for CI deploy. The run got through the tunnel, Access, and host-key verification, then failed at SSH: Permission denied (publickey). The nodes authorise only the operator's key (injected by Hetzner at provision); CI has none.
The
sshrole now installs a dedicated CI deploy key into root'sauthorized_keys-- appended, so the operator's key is untouched -- gated onci_deploy_ssh_public_key(committed public half). A separate key means CI can be revoked by deleting the line and redeploying, without touching anyone's laptop. The private half is the Actions secretWG_CI_SSH_KEY;deploy.ymlwrites it 0600 and setsANSIBLE_PRIVATE_KEY_FILE, and the guard refuses to start without it.Already installed on both nodes (verified CHANGED on both); the role keeps it idempotently.
One more secret to set:
gh secret set WG_CI_SSH_KEY -R datopian/openbases < <the ci-ssh private key>.🤖 Generated with Claude Code