Lucas WintherandClaude Opus 5
ff0a518001
check.sh is the full static gate and the single source of the tool version pins, which CI reads with --print-specs so a workflow cannot drift from what runs locally. load-ssh-key.sh is the only thing that knows where the deploy key comes from — file, CI secret, or Vault — and prints a path, never key material. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
160 lines
6.1 KiB
Bash
Executable File
160 lines
6.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
#
|
|
# Materialise the Ansible deploy SSH key and print its path on stdout.
|
|
#
|
|
# export SSH_KEY_PATH="$(scripts/load-ssh-key.sh)"
|
|
# ansible-playbook ansible/playbooks/static-site.yml
|
|
#
|
|
# Ansible itself knows exactly one thing about credentials: SSH_KEY_PATH, a path
|
|
# to a 0600 private key. This script is the only thing that knows where that key
|
|
# comes from, so adding a backend never touches the inventory or a playbook.
|
|
#
|
|
# env (default) the key is already on disk at $SSH_KEY_PATH
|
|
# ci from $SSH_PRIVATE_KEY_B64 or $SSH_PRIVATE_KEY
|
|
# (aliases: github, gitlab)
|
|
# vault from HashiCorp Vault or OpenBao, KV v2
|
|
#
|
|
# Select with the first argument or $SSH_KEY_BACKEND. Only the path is printed;
|
|
# key material never reaches stdout, a CI log, or the process list.
|
|
#
|
|
# See docs/secrets.md.
|
|
|
|
set -euo pipefail
|
|
umask 077
|
|
|
|
backend="${1:-${SSH_KEY_BACKEND:-env}}"
|
|
|
|
# Vault and OpenBao share the KV v2 API, so either works. VAULT_* is checked
|
|
# first; BAO_* is accepted so an OpenBao deployment needs no translation.
|
|
VAULT_ADDR="${VAULT_ADDR:-${BAO_ADDR:-}}"
|
|
VAULT_TOKEN="${VAULT_TOKEN:-${BAO_TOKEN:-}}"
|
|
VAULT_KV_MOUNT="${VAULT_KV_MOUNT:-${BAO_KV_MOUNT:-kv}}"
|
|
VAULT_SECRET_PATH="${VAULT_SECRET_PATH:-${BAO_SECRET_PATH:-infra/ansible/deploy-key}}"
|
|
VAULT_SECRET_FIELD="${VAULT_SECRET_FIELD:-${BAO_SECRET_FIELD:-private_key}}"
|
|
|
|
log() { printf 'load-ssh-key: %s\n' "$*" >&2; }
|
|
die() { log "$*"; exit 1; }
|
|
|
|
# GNU coreutils spells it --decode; BSD and macOS spell it -D.
|
|
decode_base64() {
|
|
if printf '' | base64 --decode >/dev/null 2>&1; then
|
|
base64 --decode
|
|
else
|
|
base64 -D
|
|
fi
|
|
}
|
|
|
|
# Write stdin to a fresh 0600 file in a private directory, validate it, print the
|
|
# path. Never echoes what it wrote.
|
|
install_key() {
|
|
local dir dest
|
|
dir="$(mktemp -d "${TMPDIR:-/tmp}/ansible-ssh.XXXXXX")"
|
|
chmod 700 "$dir"
|
|
dest="$dir/id_deploy"
|
|
|
|
cat >"$dest"
|
|
chmod 600 "$dest"
|
|
|
|
[ -s "$dest" ] || die "no key material was produced (backend: $backend)"
|
|
grep -q 'PRIVATE KEY' "$dest" \
|
|
|| die "the value fetched from $backend does not look like a private key"
|
|
|
|
# OpenSSH rejects a key whose file lacks a trailing newline.
|
|
[ -z "$(tail -c 1 "$dest")" ] || printf '\n' >>"$dest"
|
|
|
|
printf '%s\n' "$dest"
|
|
}
|
|
|
|
case "$backend" in
|
|
env)
|
|
[ -n "${SSH_KEY_PATH:-}" ] || die "SSH_KEY_PATH is not set"
|
|
[ -r "${SSH_KEY_PATH}" ] \
|
|
|| die "SSH_KEY_PATH does not point at a readable file: $SSH_KEY_PATH"
|
|
perms="$(stat -c '%a' "$SSH_KEY_PATH" 2>/dev/null || stat -f '%Lp' "$SSH_KEY_PATH")"
|
|
[ "$perms" = "600" ] || log "warning: $SSH_KEY_PATH is mode $perms; ssh wants 600"
|
|
printf '%s\n' "$SSH_KEY_PATH"
|
|
;;
|
|
|
|
ci | github | gitlab)
|
|
# Store the key base64-encoded. GitHub Actions redacts secrets from logs but
|
|
# mangles multi-line values passed through some contexts; GitLab can only
|
|
# *mask* a value that is a single line with no whitespace, which an OpenSSH
|
|
# private key never is. One encoding satisfies both:
|
|
#
|
|
# base64 -w0 < ~/.ssh/deploy_key # Linux
|
|
# base64 < ~/.ssh/deploy_key | tr -d '\n' # macOS
|
|
# [Convert]::ToBase64String(
|
|
# [IO.File]::ReadAllBytes("$HOME\.ssh\deploy_key")) # PowerShell
|
|
#
|
|
# On Windows use exactly that. certutil -encode wraps its output in a header
|
|
# and line breaks, and Get-Content re-encodes the bytes — both produce
|
|
# something that looks like base64 and decodes to an unusable key.
|
|
#
|
|
# SSH_PRIVATE_KEY is still accepted for a raw or file-backed value, and is
|
|
# treated as base64 if it is neither a path nor a PEM block.
|
|
if [ -n "${SSH_PRIVATE_KEY_B64:-}" ]; then
|
|
printf '%s' "$SSH_PRIVATE_KEY_B64" | decode_base64 | install_key
|
|
|
|
elif [ -n "${SSH_PRIVATE_KEY:-}" ]; then
|
|
if [ -f "$SSH_PRIVATE_KEY" ] && [ -r "$SSH_PRIVATE_KEY" ]; then
|
|
install_key <"$SSH_PRIVATE_KEY"
|
|
elif case "$SSH_PRIVATE_KEY" in *"PRIVATE KEY"*) true ;; *) false ;; esac; then
|
|
printf '%s' "$SSH_PRIVATE_KEY" | install_key
|
|
else
|
|
printf '%s' "$SSH_PRIVATE_KEY" | decode_base64 | install_key
|
|
fi
|
|
|
|
else
|
|
die "set SSH_PRIVATE_KEY_B64, or SSH_PRIVATE_KEY to a raw key or a path"
|
|
fi
|
|
;;
|
|
|
|
vault | openbao)
|
|
[ -n "$VAULT_ADDR" ] || die "VAULT_ADDR (or BAO_ADDR) is not set"
|
|
[ -n "$VAULT_TOKEN" ] || die "VAULT_TOKEN (or BAO_TOKEN) is not set"
|
|
|
|
cli=""
|
|
command -v vault >/dev/null 2>&1 && cli=vault
|
|
[ -z "$cli" ] && command -v bao >/dev/null 2>&1 && cli=bao
|
|
|
|
if [ -n "$cli" ]; then
|
|
# `env` rather than bare NAME=value prefixes: in `A=1 B=$A cmd` the $A
|
|
# expands to the *outer* A, which reads as a bug even when it is not. Both
|
|
# spellings are set for the command only, never exported to this shell.
|
|
material="$(
|
|
env VAULT_ADDR="$VAULT_ADDR" VAULT_TOKEN="$VAULT_TOKEN" \
|
|
BAO_ADDR="$VAULT_ADDR" BAO_TOKEN="$VAULT_TOKEN" \
|
|
"$cli" kv get -mount="$VAULT_KV_MOUNT" \
|
|
-field="$VAULT_SECRET_FIELD" "$VAULT_SECRET_PATH"
|
|
)" || die "'$cli kv get' failed for $VAULT_KV_MOUNT/$VAULT_SECRET_PATH"
|
|
|
|
elif command -v curl >/dev/null 2>&1 && command -v python3 >/dev/null 2>&1; then
|
|
# -H keeps the token out of the process list. This is the KV v2 data
|
|
# endpoint; KV v1 has no /data/ segment.
|
|
response="$(
|
|
curl --fail --silent --show-error \
|
|
-H "X-Vault-Token: $VAULT_TOKEN" \
|
|
"$VAULT_ADDR/v1/$VAULT_KV_MOUNT/data/$VAULT_SECRET_PATH"
|
|
)" || die "request to $VAULT_ADDR failed — check the token, and that the vault is unsealed"
|
|
|
|
# The field name goes in as argv, not interpolated into the program text.
|
|
material="$(printf '%s' "$response" | python3 -c 'import json, sys
|
|
try:
|
|
print(json.load(sys.stdin)["data"]["data"][sys.argv[1]], end="")
|
|
except (ValueError, KeyError, TypeError):
|
|
sys.exit(1)
|
|
' "$VAULT_SECRET_FIELD")" \
|
|
|| die "no field '$VAULT_SECRET_FIELD' in $VAULT_KV_MOUNT/$VAULT_SECRET_PATH"
|
|
|
|
else
|
|
die "need either the 'vault' or 'bao' CLI, or curl + python3"
|
|
fi
|
|
|
|
printf '%s' "$material" | install_key
|
|
;;
|
|
|
|
*)
|
|
die "unknown backend '$backend' (expected: env, ci, vault)"
|
|
;;
|
|
esac
|