diff options
| -rwxr-xr-x | git/install.sh | 16 |
1 files changed, 13 insertions, 3 deletions
diff --git a/git/install.sh b/git/install.sh index d4522ea..38bc8a8 100755 --- a/git/install.sh +++ b/git/install.sh @@ -8,6 +8,8 @@ APP_DIR="$(cd "$(dirname "$0")/.." && pwd)" REPOS_FILE="$APP_DIR/git/repos.txt" HOOKS_SRC="$APP_DIR/git/hooks" AUTH_KEYS_SRC="$APP_DIR/server/authorized_keys" +ADMIN_PUBKEY="$APP_DIR/hetzner-admin/id_rsa.pub" +ADMIN_KEY_RESTRICTION='command="/app/infra/hetzner-admin/run-command.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty' if [[ "$(id -u)" -ne 0 ]]; then echo "ERROR: root として実行してください" >&2 @@ -18,11 +20,19 @@ echo "=== SSH authorized_keys ===" if [[ -f "$AUTH_KEYS_SRC" ]]; then mkdir -p /root/.ssh chmod 700 /root/.ssh - if diff -q "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys >/dev/null 2>&1; then + # server/authorized_keys + hetzner-admin のコマンド制限付き鍵（あれば）で組み立てる。 + # 丸ごと上書きすると hetzner-admin の鍵が消えて管理画面の操作が認証失敗になるため + tmp="$(mktemp)" + cat "$AUTH_KEYS_SRC" > "$tmp" + if [[ -f "$ADMIN_PUBKEY" ]]; then + echo "${ADMIN_KEY_RESTRICTION} $(cat "$ADMIN_PUBKEY")" >> "$tmp" + fi + if diff -q "$tmp" /root/.ssh/authorized_keys >/dev/null 2>&1; then + rm -f "$tmp" echo " unchanged" else - cp "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys - chmod 600 /root/.ssh/authorized_keys + install -m 600 "$tmp" /root/.ssh/authorized_keys + rm -f "$tmp" echo " installed" fi fi |