Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

kandra: Puppet github.com keys to both root and zulip users. 

We update to add the ecdsa-sha2-nistp256 key as well.
This commit is contained in:
Alex Vandiver 2024-02-07 12:23:28 -05:00 committed by Tim Abbott
parent b1f899512a
commit 3d63a87384
4 changed files with 20 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
puppet/kandra/files/github.keys Normal file
View File

@ -0,0 +1,3 @@
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=

2
puppet/kandra/manifests/profile/base.pp
View File

@ -63,11 +63,13 @@ class kandra::profile::base {
home => '/root', home => '/root',
keys => 'internal-read-only-deploy-key', keys => 'internal-read-only-deploy-key',
authorized_keys => 'common', authorized_keys => 'common',
known_hosts => ['github.com'],
} }
kandra::user_dotfiles { 'zulip': kandra::user_dotfiles { 'zulip':
keys => 'internal-read-only-deploy-key', keys => 'internal-read-only-deploy-key',
authorized_keys => 'common', authorized_keys => 'common',
known_hosts => ['github.com'],
} }
service { 'ssh': service { 'ssh':

9
puppet/kandra/manifests/user_dotfiles.pp
View File

@ -64,6 +64,14 @@ define kandra::user_dotfiles (
require => File["${homedir}/.ssh"], require => File["${homedir}/.ssh"],
} }
$known_hosts.each |String $hostname| { $known_hosts.each |String $hostname| {
if $hostname == 'github.com' {
$github_keys = file('kandra/github.keys')
exec { "${user} ssh known_hosts ${hostname}":
command => "echo '${github_keys}' >> ${homedir}/.ssh/known_hosts",
unless => "grep ${hostname} ${homedir}/.ssh/known_hosts",
require => File["${homedir}/.ssh/known_hosts"],
}
} else {
exec { "${user} ssh known_hosts ${hostname}": exec { "${user} ssh known_hosts ${hostname}":
command => "ssh-keyscan ${hostname} >> ${homedir}/.ssh/known_hosts", command => "ssh-keyscan ${hostname} >> ${homedir}/.ssh/known_hosts",
unless => "grep ${hostname} ${homedir}/.ssh/known_hosts", unless => "grep ${hostname} ${homedir}/.ssh/known_hosts",
@ -72,3 +80,4 @@ define kandra::user_dotfiles (
} }
} }
} }
}

6
tools/setup/bootstrap-aws-installer
View File

@ -63,10 +63,8 @@ INSTALL_SSH_KEYS="inline!puppet/kandra/files/install-ssh-keys"
# Provide GitHub known_hosts setup; you can verify against fingerprints at # Provide GitHub known_hosts setup; you can verify against fingerprints at
# https://docs.github.com/en/github/authenticating-to-github/githubs-ssh-key-fingerprints # https://docs.github.com/en/github/authenticating-to-github/githubs-ssh-key-fingerprints
# via `ssh-keygen -lf` # via `ssh-keygen -lf`
cat >/root/.ssh/known_hosts <<EOF GITHUB_KEYS="inline!puppet/kandra/files/github.keys"
github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl cat "$GITHUB_KEYS" >>/root/.ssh/known_hosts
github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
EOF
cd /root cd /root
git clone "$REPO_URL" zulip -b "$BRANCH" git clone "$REPO_URL" zulip -b "$BRANCH"