From 77f156318e9db65dcd2fbc33c2fbb534e2887b20 Mon Sep 17 00:00:00 2001 From: autonomic-bot Date: Mon, 7 Sep 2026 21:32:50 +0000 Subject: [PATCH] =?UTF-8?q?README=20=C2=A74b:=20the=20bot=20deploy=20key?= =?UTF-8?q?=20is=20generated=20on=20the=20host;=20master=20age=20key=20onl?= =?UTF-8?q?y=20for=20the=20first=20deploy?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01FqkQq3CDmFWcQ7u1LzoyRz --- README.md | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 15e2568..004ef49 100644 --- a/README.md +++ b/README.md @@ -34,8 +34,9 @@ can repeat it. Read it once before starting; the order matters. public keys that get root are tracked in `nix/hosts/cc-ci/ssh-keys` (one per line). Password login is disabled and fail2ban watches sshd, so a key is the only way in. - Read access to `recipe-maintainers/cc-ci`, `recipe-maintainers/cc-ci-orchestrator` (both public - read) and the **private** `recipe-maintainers/cc-ci-secrets` (the `autonomic-bot` deploy key, - `autonomic-bot-gitea-ed25519`, has it). + read) and the **private** `recipe-maintainers/cc-ci-secrets` (the `autonomic-bot` account has + it; the host gets its own deploy key on that account, §4b/§4c — and the bot password, in + `.testenv`, is what registers it). - The out-of-band secrets listed in §4. If you are migrating, they come from the old host; if you are starting fresh you create them (each row says how). - Control of the DNS zone (Gandi for `commoninternet.net`) for the cutover in §7. @@ -170,19 +171,21 @@ traffic is docker-forwarded, not host INPUT). ### 4b. The CI server's checkout and its one out-of-band secret ```bash -# root's deploy key for the private cc-ci-secrets submodule +# the bot deploy key for the private cc-ci-secrets submodule — generated ON this host by loops +# (§4c) and registered on the autonomic-bot Gitea account; root only points at it: install -d -m700 /root/.ssh -install -m600 /root/.ssh/autonomic-bot-gitea-ed25519 -cat > /root/.ssh/config <<'EOF' +cat > /root/.ssh/config <<'SSHCFG' Host git.autonomic.zone Port 2222 User git - IdentityFile /root/.ssh/autonomic-bot-gitea-ed25519 + IdentityFile /secrets/files/autonomic-bot-cc-ci-ed25519 IdentitiesOnly yes -EOF +SSHCFG # the deployed checkout: nightly-sweep runs from it, sops reads secrets/secrets.yaml from it git clone --recursive https://git.autonomic.zone/recipe-maintainers/cc-ci.git /etc/cc-ci -# the master (recovery) age key — the only sops recipient a fresh host can be +# the age identity sops-nix decrypts with. FIRST deploy of a host that is not yet a recipient: +# the master (recovery) key, temporarily. Once the host is a recipient (below): its own +# ssh-host-key-derived identity, and the master key leaves the box. install -d -m700 /var/lib/sops-nix install -m600 /var/lib/sops-nix/key.txt ```