From f48002a02c7b75de8add369672c861f63e900df4 Mon Sep 17 00:00:00 2001 From: yyamashita Date: Sat, 31 Oct 2026 19:55:08 +0900 Subject: git/install.sh: keep hetzner-admin SSH key when installing authorized_keys install.sh overwrote /root/.ssh/authorized_keys with server/authorized_keys, dropping the restricted hetzner-admin key and making every admin UI command fail with an SSH authentication error. Append it on install. Co-Authored-By: Claude Opus 5.5 --- git/install.sh | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/git/install.sh b/git/install.sh index d4522ea..38bc8a8 100755 --- a/git/install.sh +++ b/git/install.sh @@ -8,6 +8,8 @@ APP_DIR="$(cd "$(dirname "$0")/.." && pwd)" REPOS_FILE="$APP_DIR/git/repos.txt" HOOKS_SRC="$APP_DIR/git/hooks" AUTH_KEYS_SRC="$APP_DIR/server/authorized_keys" +ADMIN_PUBKEY="$APP_DIR/hetzner-admin/id_rsa.pub" +ADMIN_KEY_RESTRICTION='command="/app/infra/hetzner-admin/run-command.sh",no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty' if [[ "$(id -u)" -ne 0 ]]; then echo "ERROR: root として実行してください" >&2 @@ -18,11 +20,19 @@ echo "=== SSH authorized_keys ===" if [[ -f "$AUTH_KEYS_SRC" ]]; then mkdir -p /root/.ssh chmod 700 /root/.ssh - if diff -q "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys >/dev/null 2>&1; then + # server/authorized_keys + hetzner-admin のコマンド制限付き鍵（あれば）で組み立てる。 + # 丸ごと上書きすると hetzner-admin の鍵が消えて管理画面の操作が認証失敗になるため + tmp="$(mktemp)" + cat "$AUTH_KEYS_SRC" > "$tmp" + if [[ -f "$ADMIN_PUBKEY" ]]; then + echo "${ADMIN_KEY_RESTRICTION} $(cat "$ADMIN_PUBKEY")" >> "$tmp" + fi + if diff -q "$tmp" /root/.ssh/authorized_keys >/dev/null 2>&1; then + rm -f "$tmp" echo " unchanged" else - cp "$AUTH_KEYS_SRC" /root/.ssh/authorized_keys - chmod 600 /root/.ssh/authorized_keys + install -m 600 "$tmp" /root/.ssh/authorized_keys + rm -f "$tmp" echo " installed" fi fi -- cgit v1.3