Add the check and deploy-key scripts
check.sh is the full static gate and the single source of the tool version pins, which CI reads with --print-specs so a workflow cannot drift from what runs locally. load-ssh-key.sh is the only thing that knows where the deploy key comes from — file, CI secret, or Vault — and prints a path, never key material. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
This commit is contained in:
Lucas Winther
co-authored by
Claude Opus 5
Claude Opus 5
parent
b76c76e3b0
commit
ff0a518001
Executable
+159
@@ -0,0 +1,159 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Materialise the Ansible deploy SSH key and print its path on stdout.
|
||||
#
|
||||
# export SSH_KEY_PATH="$(scripts/load-ssh-key.sh)"
|
||||
# ansible-playbook ansible/playbooks/static-site.yml
|
||||
#
|
||||
# Ansible itself knows exactly one thing about credentials: SSH_KEY_PATH, a path
|
||||
# to a 0600 private key. This script is the only thing that knows where that key
|
||||
# comes from, so adding a backend never touches the inventory or a playbook.
|
||||
#
|
||||
# env (default) the key is already on disk at $SSH_KEY_PATH
|
||||
# ci from $SSH_PRIVATE_KEY_B64 or $SSH_PRIVATE_KEY
|
||||
# (aliases: github, gitlab)
|
||||
# vault from HashiCorp Vault or OpenBao, KV v2
|
||||
#
|
||||
# Select with the first argument or $SSH_KEY_BACKEND. Only the path is printed;
|
||||
# key material never reaches stdout, a CI log, or the process list.
|
||||
#
|
||||
# See docs/secrets.md.
|
||||
|
||||
set -euo pipefail
|
||||
umask 077
|
||||
|
||||
backend="${1:-${SSH_KEY_BACKEND:-env}}"
|
||||
|
||||
# Vault and OpenBao share the KV v2 API, so either works. VAULT_* is checked
|
||||
# first; BAO_* is accepted so an OpenBao deployment needs no translation.
|
||||
VAULT_ADDR="${VAULT_ADDR:-${BAO_ADDR:-}}"
|
||||
VAULT_TOKEN="${VAULT_TOKEN:-${BAO_TOKEN:-}}"
|
||||
VAULT_KV_MOUNT="${VAULT_KV_MOUNT:-${BAO_KV_MOUNT:-kv}}"
|
||||
VAULT_SECRET_PATH="${VAULT_SECRET_PATH:-${BAO_SECRET_PATH:-infra/ansible/deploy-key}}"
|
||||
VAULT_SECRET_FIELD="${VAULT_SECRET_FIELD:-${BAO_SECRET_FIELD:-private_key}}"
|
||||
|
||||
log() { printf 'load-ssh-key: %s\n' "$*" >&2; }
|
||||
die() { log "$*"; exit 1; }
|
||||
|
||||
# GNU coreutils spells it --decode; BSD and macOS spell it -D.
|
||||
decode_base64() {
|
||||
if printf '' | base64 --decode >/dev/null 2>&1; then
|
||||
base64 --decode
|
||||
else
|
||||
base64 -D
|
||||
fi
|
||||
}
|
||||
|
||||
# Write stdin to a fresh 0600 file in a private directory, validate it, print the
|
||||
# path. Never echoes what it wrote.
|
||||
install_key() {
|
||||
local dir dest
|
||||
dir="$(mktemp -d "${TMPDIR:-/tmp}/ansible-ssh.XXXXXX")"
|
||||
chmod 700 "$dir"
|
||||
dest="$dir/id_deploy"
|
||||
|
||||
cat >"$dest"
|
||||
chmod 600 "$dest"
|
||||
|
||||
[ -s "$dest" ] || die "no key material was produced (backend: $backend)"
|
||||
grep -q 'PRIVATE KEY' "$dest" \
|
||||
|| die "the value fetched from $backend does not look like a private key"
|
||||
|
||||
# OpenSSH rejects a key whose file lacks a trailing newline.
|
||||
[ -z "$(tail -c 1 "$dest")" ] || printf '\n' >>"$dest"
|
||||
|
||||
printf '%s\n' "$dest"
|
||||
}
|
||||
|
||||
case "$backend" in
|
||||
env)
|
||||
[ -n "${SSH_KEY_PATH:-}" ] || die "SSH_KEY_PATH is not set"
|
||||
[ -r "${SSH_KEY_PATH}" ] \
|
||||
|| die "SSH_KEY_PATH does not point at a readable file: $SSH_KEY_PATH"
|
||||
perms="$(stat -c '%a' "$SSH_KEY_PATH" 2>/dev/null || stat -f '%Lp' "$SSH_KEY_PATH")"
|
||||
[ "$perms" = "600" ] || log "warning: $SSH_KEY_PATH is mode $perms; ssh wants 600"
|
||||
printf '%s\n' "$SSH_KEY_PATH"
|
||||
;;
|
||||
|
||||
ci | github | gitlab)
|
||||
# Store the key base64-encoded. GitHub Actions redacts secrets from logs but
|
||||
# mangles multi-line values passed through some contexts; GitLab can only
|
||||
# *mask* a value that is a single line with no whitespace, which an OpenSSH
|
||||
# private key never is. One encoding satisfies both:
|
||||
#
|
||||
# base64 -w0 < ~/.ssh/deploy_key # Linux
|
||||
# base64 < ~/.ssh/deploy_key | tr -d '\n' # macOS
|
||||
# [Convert]::ToBase64String(
|
||||
# [IO.File]::ReadAllBytes("$HOME\.ssh\deploy_key")) # PowerShell
|
||||
#
|
||||
# On Windows use exactly that. certutil -encode wraps its output in a header
|
||||
# and line breaks, and Get-Content re-encodes the bytes — both produce
|
||||
# something that looks like base64 and decodes to an unusable key.
|
||||
#
|
||||
# SSH_PRIVATE_KEY is still accepted for a raw or file-backed value, and is
|
||||
# treated as base64 if it is neither a path nor a PEM block.
|
||||
if [ -n "${SSH_PRIVATE_KEY_B64:-}" ]; then
|
||||
printf '%s' "$SSH_PRIVATE_KEY_B64" | decode_base64 | install_key
|
||||
|
||||
elif [ -n "${SSH_PRIVATE_KEY:-}" ]; then
|
||||
if [ -f "$SSH_PRIVATE_KEY" ] && [ -r "$SSH_PRIVATE_KEY" ]; then
|
||||
install_key <"$SSH_PRIVATE_KEY"
|
||||
elif case "$SSH_PRIVATE_KEY" in *"PRIVATE KEY"*) true ;; *) false ;; esac; then
|
||||
printf '%s' "$SSH_PRIVATE_KEY" | install_key
|
||||
else
|
||||
printf '%s' "$SSH_PRIVATE_KEY" | decode_base64 | install_key
|
||||
fi
|
||||
|
||||
else
|
||||
die "set SSH_PRIVATE_KEY_B64, or SSH_PRIVATE_KEY to a raw key or a path"
|
||||
fi
|
||||
;;
|
||||
|
||||
vault | openbao)
|
||||
[ -n "$VAULT_ADDR" ] || die "VAULT_ADDR (or BAO_ADDR) is not set"
|
||||
[ -n "$VAULT_TOKEN" ] || die "VAULT_TOKEN (or BAO_TOKEN) is not set"
|
||||
|
||||
cli=""
|
||||
command -v vault >/dev/null 2>&1 && cli=vault
|
||||
[ -z "$cli" ] && command -v bao >/dev/null 2>&1 && cli=bao
|
||||
|
||||
if [ -n "$cli" ]; then
|
||||
# `env` rather than bare NAME=value prefixes: in `A=1 B=$A cmd` the $A
|
||||
# expands to the *outer* A, which reads as a bug even when it is not. Both
|
||||
# spellings are set for the command only, never exported to this shell.
|
||||
material="$(
|
||||
env VAULT_ADDR="$VAULT_ADDR" VAULT_TOKEN="$VAULT_TOKEN" \
|
||||
BAO_ADDR="$VAULT_ADDR" BAO_TOKEN="$VAULT_TOKEN" \
|
||||
"$cli" kv get -mount="$VAULT_KV_MOUNT" \
|
||||
-field="$VAULT_SECRET_FIELD" "$VAULT_SECRET_PATH"
|
||||
)" || die "'$cli kv get' failed for $VAULT_KV_MOUNT/$VAULT_SECRET_PATH"
|
||||
|
||||
elif command -v curl >/dev/null 2>&1 && command -v python3 >/dev/null 2>&1; then
|
||||
# -H keeps the token out of the process list. This is the KV v2 data
|
||||
# endpoint; KV v1 has no /data/ segment.
|
||||
response="$(
|
||||
curl --fail --silent --show-error \
|
||||
-H "X-Vault-Token: $VAULT_TOKEN" \
|
||||
"$VAULT_ADDR/v1/$VAULT_KV_MOUNT/data/$VAULT_SECRET_PATH"
|
||||
)" || die "request to $VAULT_ADDR failed — check the token, and that the vault is unsealed"
|
||||
|
||||
# The field name goes in as argv, not interpolated into the program text.
|
||||
material="$(printf '%s' "$response" | python3 -c 'import json, sys
|
||||
try:
|
||||
print(json.load(sys.stdin)["data"]["data"][sys.argv[1]], end="")
|
||||
except (ValueError, KeyError, TypeError):
|
||||
sys.exit(1)
|
||||
' "$VAULT_SECRET_FIELD")" \
|
||||
|| die "no field '$VAULT_SECRET_FIELD' in $VAULT_KV_MOUNT/$VAULT_SECRET_PATH"
|
||||
|
||||
else
|
||||
die "need either the 'vault' or 'bao' CLI, or curl + python3"
|
||||
fi
|
||||
|
||||
printf '%s' "$material" | install_key
|
||||
;;
|
||||
|
||||
*)
|
||||
die "unknown backend '$backend' (expected: env, ci, vault)"
|
||||
;;
|
||||
esac
|
||||
Reference in New Issue
Block a user