42 lines
1.4 KiB
Bash
Executable File
42 lines
1.4 KiB
Bash
Executable File
#!/bin/bash
|
|
# ansipa-git-add-deploy-key.sh — register a node's read-only deploy key with
|
|
# the ANSIPA git server (see ansipa-git-server-setup.sh).
|
|
#
|
|
# The key is forced to git-upload-pack (fetch-only) at the transport layer —
|
|
# defense in depth; GPG commit signing remains the real trust boundary, so a
|
|
# leaked deploy key only grants read access to already-signed history.
|
|
#
|
|
# Usage (run inside the container, e.g. `docker exec freeipa ...`):
|
|
# ansipa-git-add-deploy-key.sh "ssh-ed25519 AAAA...== node.example.com"
|
|
|
|
set -euo pipefail
|
|
|
|
PERSIST_BASE="/data/git-server"
|
|
AUTHKEYS="$PERSIST_BASE/authorized_keys"
|
|
GIT_HOME="/srv/git"
|
|
REPO_DIR="$GIT_HOME/ansipa-policy.git"
|
|
|
|
[[ $# -eq 1 ]] || { echo "Usage: $0 \"<ssh-public-key> [comment]\"" >&2; exit 1; }
|
|
PUBKEY="$1"
|
|
|
|
[[ "$PUBKEY" =~ ^(ssh-ed25519|ssh-rsa|ecdsa-sha2-) ]] || {
|
|
echo "ERROR: doesn't look like an SSH public key" >&2; exit 1;
|
|
}
|
|
|
|
mkdir -p "$PERSIST_BASE"
|
|
touch "$AUTHKEYS"
|
|
|
|
LINE="command=\"git-upload-pack ${REPO_DIR}\",no-port-forwarding,no-X11-forwarding,no-pty,no-agent-forwarding ${PUBKEY}"
|
|
|
|
if grep -qF "$PUBKEY" "$AUTHKEYS" 2>/dev/null; then
|
|
echo "Key already present — skipping." >&2
|
|
exit 0
|
|
fi
|
|
|
|
echo "$LINE" >> "$AUTHKEYS"
|
|
cp "$AUTHKEYS" "$GIT_HOME/.ssh/authorized_keys"
|
|
chown git:git "$GIT_HOME/.ssh/authorized_keys"
|
|
chmod 600 "$GIT_HOME/.ssh/authorized_keys"
|
|
|
|
echo "Added read-only deploy key (forced git-upload-pack, ${REPO_DIR})."
|