cadey
/
propellor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

sshPubKey is renamed to Ssh.pubKey

This commit is contained in:
Joey Hess 2015-01-04 15:36:10 -04:00
parent 0f41071cb5
commit 52664e6220
6 changed files with 23 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
config-joey.hs
View File

@ -278,7 +278,7 @@ elephant = standardSystem "elephant.kitenet.net" Unstable "amd64"
& Systemd.installed & Systemd.installed
& Systemd.persistentJournal & Systemd.persistentJournal
& Ssh.hostKeys hostContext & Ssh.hostKeys hostContext
& sshPubKey "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAJkoPRhUGT8EId6m37uBdYEtq42VNwslKnc9mmO+89ody066q6seHKeFY6ImfwjcyIjM30RTzEwftuVNQnbEB0=" & Ssh.pubKey "ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBAJkoPRhUGT8EId6m37uBdYEtq42VNwslKnc9mmO+89ody066q6seHKeFY6ImfwjcyIjM30RTzEwftuVNQnbEB0="
& Ssh.keyImported SshRsa "joey" hostContext & Ssh.keyImported SshRsa "joey" hostContext
& Apt.serviceInstalledRunning "swapspace" & Apt.serviceInstalledRunning "swapspace"
@ -459,9 +459,9 @@ myDnsPrimary dnssec domain extras = (if dnssec then Dns.signedPrimary (Weekly No
monsters :: [Host] -- Systems I don't manage with propellor, monsters :: [Host] -- Systems I don't manage with propellor,
monsters = -- but do want to track their public keys etc. monsters = -- but do want to track their public keys etc.
[ host "usw-s002.rsync.net" [ host "usw-s002.rsync.net"
& sshPubKey "ssh-dss AAAAB3NzaC1kc3MAAAEBAI6ZsoW8a+Zl6NqUf9a4xXSMcV1akJHDEKKBzlI2YZo9gb9YoCf5p9oby8THUSgfh4kse7LJeY7Nb64NR6Y/X7I2/QzbE1HGGl5mMwB6LeUcJ74T3TQAlNEZkGt/MOIVLolJHk049hC09zLpkUDtX8K0t1yaCirC9SxDGLTCLEhvU9+vVdVrdQlKZ9wpLUNbdAzvbra+O/IVvExxDZ9WCHrnfNA8ddVZIGEWMqsoNgiuCxiXpi8qL+noghsSQNFTXwo7W2Vp9zj1JkCt3GtSz5IzEpARQaXEAWNEM0n1nJ686YUOhou64iRM8bPC1lp3QXvvZNgj3m+QHhIempx+de8AAAAVAKB5vUDaZOg14gRn7Bp81ja/ik+RAAABACPH/bPbW912x1NxNiikzGR6clLh+bLpIp8Qie3J7DwOr8oC1QOKjNDK+UgQ7mDQEgr4nGjNKSvpDi4c1QCw4sbLqQgx1y2VhT0SmUPHf5NQFldRQyR/jcevSSwOBxszz3aq9AwHiv9OWaO3XY18suXPouiuPTpIcZwc2BLDNHFnDURQeGEtmgqj6gZLIkTY0iw7q9Tj5FOyl4AkvEJC5B4CSzaWgey93Wqn1Imt7KI8+H9lApMKziVL1q+K7xAuNkGmx5YOSNlE6rKAPtsIPHZGxR7dch0GURv2jhh0NQYvBRn3ukCjuIO5gx56HLgilq59/o50zZ4NcT7iASF76TcAAAEAC6YxX7rrs8pp13W4YGiJHwFvIO1yXLGOdqu66JM0plO4J1ItV1AQcazOXLiliny3p2/W+wXZZKd5HIRt52YafCA8YNyMk/sF7JcTR4d4z9CfKaAxh0UpzKiAk+0j/Wu3iPoTOsyt7N0j1+dIyrFodY2sKKuBMT4TQ0yqQpbC+IDQv2i1IlZAPneYGfd5MIGygs2QMfaMQ1jWAKJvEO0vstZ7GB6nDAcg4in3ZiBHtomx3PL5w+zg48S4Ed69BiFXLZ1f6MnjpUOP75pD4MP6toS0rgK9b93xCrEQLgm4oD/7TCHHBo2xR7wwcsN2OddtwWsEM2QgOkt/jdCAoVCqwQ==" & Ssh.pubKey "ssh-dss AAAAB3NzaC1kc3MAAAEBAI6ZsoW8a+Zl6NqUf9a4xXSMcV1akJHDEKKBzlI2YZo9gb9YoCf5p9oby8THUSgfh4kse7LJeY7Nb64NR6Y/X7I2/QzbE1HGGl5mMwB6LeUcJ74T3TQAlNEZkGt/MOIVLolJHk049hC09zLpkUDtX8K0t1yaCirC9SxDGLTCLEhvU9+vVdVrdQlKZ9wpLUNbdAzvbra+O/IVvExxDZ9WCHrnfNA8ddVZIGEWMqsoNgiuCxiXpi8qL+noghsSQNFTXwo7W2Vp9zj1JkCt3GtSz5IzEpARQaXEAWNEM0n1nJ686YUOhou64iRM8bPC1lp3QXvvZNgj3m+QHhIempx+de8AAAAVAKB5vUDaZOg14gRn7Bp81ja/ik+RAAABACPH/bPbW912x1NxNiikzGR6clLh+bLpIp8Qie3J7DwOr8oC1QOKjNDK+UgQ7mDQEgr4nGjNKSvpDi4c1QCw4sbLqQgx1y2VhT0SmUPHf5NQFldRQyR/jcevSSwOBxszz3aq9AwHiv9OWaO3XY18suXPouiuPTpIcZwc2BLDNHFnDURQeGEtmgqj6gZLIkTY0iw7q9Tj5FOyl4AkvEJC5B4CSzaWgey93Wqn1Imt7KI8+H9lApMKziVL1q+K7xAuNkGmx5YOSNlE6rKAPtsIPHZGxR7dch0GURv2jhh0NQYvBRn3ukCjuIO5gx56HLgilq59/o50zZ4NcT7iASF76TcAAAEAC6YxX7rrs8pp13W4YGiJHwFvIO1yXLGOdqu66JM0plO4J1ItV1AQcazOXLiliny3p2/W+wXZZKd5HIRt52YafCA8YNyMk/sF7JcTR4d4z9CfKaAxh0UpzKiAk+0j/Wu3iPoTOsyt7N0j1+dIyrFodY2sKKuBMT4TQ0yqQpbC+IDQv2i1IlZAPneYGfd5MIGygs2QMfaMQ1jWAKJvEO0vstZ7GB6nDAcg4in3ZiBHtomx3PL5w+zg48S4Ed69BiFXLZ1f6MnjpUOP75pD4MP6toS0rgK9b93xCrEQLgm4oD/7TCHHBo2xR7wwcsN2OddtwWsEM2QgOkt/jdCAoVCqwQ=="
, host "github.com" , host "github.com"
& sshPubKey "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ==" & Ssh.pubKey "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAq2A7hRGmdnm9tUDbO9IDSwBK6TbQa+PXYPCPy6rbTrTtw7PHkccKrpp0yVhp5HdEIcKr6pLlVDBfOLX9QUsyCOV0wzfjIJNlGEYsdlLJizHhbn2mUjvSAHQqZETYP81eFzLQNnPHt4EVVUh7VfDESU84KezmD5QlWpXLmvU31/yMf+Se8xhHTvKSCZIFImWwoG6mbUoWf9nzpIoaSjB+weqqUUmpaaasXVal72J+UX2B+2RPW3RcT0eOzQgqlJL3RKrTJvdsjE3JEAvGq3lGHSZXy28G3skua2SmVi/w4yCE6gbODqnTWlg7+wC604ydGXA8VJiS5ap43JXiUFFAaQ=="
, host "ns6.gandi.net" , host "ns6.gandi.net"
& ipv4 "217.70.177.40" & ipv4 "217.70.177.40"
, host "turtle.kitenet.net" , host "turtle.kitenet.net"
@ -469,7 +469,7 @@ monsters = -- but do want to track their public keys etc.
& ipv6 "2001:4978:f:2d9::2" & ipv6 "2001:4978:f:2d9::2"
& alias "backup.kitenet.net" & alias "backup.kitenet.net"
& alias "usbackup.kitenet.net" & alias "usbackup.kitenet.net"
& sshPubKey "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAokMXQiX/NZjA1UbhMdgAscnS5dsmy+Q7bWrQ6tsTZ/o+6N/T5cbjoBHOdpypXJI3y/PiJTDJaQtXIhLa8gFg/EvxMnMz/KG9skADW1361JmfCc4BxicQIO2IOOe6eilPr+YsnOwiHwL0vpUnuty39cppuMWVD25GzxXlS6KQsLCvXLzxLLuNnGC43UAM0q4UwQxDtAZEK1dH2o3HMWhgMP2qEQupc24dbhpO3ecxh2C9678a3oGDuDuNf7mLp3s7ptj5qF3onitpJ82U5o7VajaHoygMaSRFeWxP2c13eM57j3bLdLwxVXFhePcKXARu1iuFTLS5uUf3hN6MkQcOGw==" & Ssh.pubKey "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAokMXQiX/NZjA1UbhMdgAscnS5dsmy+Q7bWrQ6tsTZ/o+6N/T5cbjoBHOdpypXJI3y/PiJTDJaQtXIhLa8gFg/EvxMnMz/KG9skADW1361JmfCc4BxicQIO2IOOe6eilPr+YsnOwiHwL0vpUnuty39cppuMWVD25GzxXlS6KQsLCvXLzxLLuNnGC43UAM0q4UwQxDtAZEK1dH2o3HMWhgMP2qEQupc24dbhpO3ecxh2C9678a3oGDuDuNf7mLp3s7ptj5qF3onitpJ82U5o7VajaHoygMaSRFeWxP2c13eM57j3bLdLwxVXFhePcKXARu1iuFTLS5uUf3hN6MkQcOGw=="
, host "old.kitenet.net" , host "old.kitenet.net"
& ipv4 "80.68.85.49" & ipv4 "80.68.85.49"
, host "mouse.kitenet.net" , host "mouse.kitenet.net"

3
debian/changelog vendored
View File

@ -1,4 +1,4 @@
propellor (1.2.3) UNRELEASED; urgency=medium propellor (1.3.0) UNRELEASED; urgency=medium
* --spin checks if the DNS matches any configured IP address property * --spin checks if the DNS matches any configured IP address property
of the host, and if not, sshes to the host by IP address. of the host, and if not, sshes to the host by IP address.
@ -6,6 +6,7 @@ propellor (1.2.3) UNRELEASED; urgency=medium
that docker exec doesn't enter a chroot. that docker exec doesn't enter a chroot.
* Update intermediary propellor in --spin --via * Update intermediary propellor in --spin --via
* Added support for DNSSEC. * Added support for DNSSEC.
* sshPubKey is renamed to Ssh.pubKey
* Fix build with process 1.2.1.0. * Fix build with process 1.2.1.0.
-- Joey Hess <id@joeyh.name> Thu, 01 Jan 2015 13:27:23 -0400 -- Joey Hess <id@joeyh.name> Thu, 01 Jan 2015 13:27:23 -0400

2
propellor.cabal
View File

@ -1,5 +1,5 @@
Name: propellor Name: propellor
Version: 1.2.2 Version: 1.3.0
Cabal-Version: >= 1.6 Cabal-Version: >= 1.6
License: BSD3 License: BSD3
Maintainer: Joey Hess <id@joeyh.name> Maintainer: Joey Hess <id@joeyh.name>

2
src/Propellor/Engine.hs
View File

@ -77,7 +77,7 @@ ensureProperties ps = ensure ps NoChange
-- | Lifts an action into a different host. -- | Lifts an action into a different host.
-- --
-- For example, `fromHost hosts "otherhost" getSshPubKey` -- For example, `fromHost hosts "otherhost" getPubKey`
fromHost :: [Host] -> HostName -> Propellor a -> Propellor (Maybe a) fromHost :: [Host] -> HostName -> Propellor a -> Propellor (Maybe a)
fromHost l hn getter = case findHost l hn of fromHost l hn getter = case findHost l hn of
Nothing -> return Nothing Nothing -> return Nothing

7
src/Propellor/Info.hs
View File

@ -70,13 +70,6 @@ addDNS r = pureInfoProperty (rdesc r) $ mempty { _dns = S.singleton r }
ddesc (RelDomain domain) = domain ddesc (RelDomain domain) = domain
ddesc RootDomain = "@" ddesc RootDomain = "@"
sshPubKey :: String -> Property
sshPubKey k = pureInfoProperty ("ssh pubkey known") $
mempty { _sshPubKey = Val k }
getSshPubKey :: Propellor (Maybe String)
getSshPubKey = askInfo _sshPubKey
hostMap :: [Host] -> M.Map HostName Host hostMap :: [Host] -> M.Map HostName Host
hostMap l = M.fromList $ zip (map hostName l) l hostMap l = M.fromList $ zip (map hostName l) l

19
src/Propellor/Property/Ssh.hs
View File

@ -6,6 +6,7 @@ module Propellor.Property.Ssh (
authorizedKey, authorizedKey,
restarted, restarted,
randomHostKeys, randomHostKeys,
pubKey,
hostKeys, hostKeys,
hostKey, hostKey,
keyImported, keyImported,
@ -79,7 +80,16 @@ randomHostKeys = flagFile prop "/etc/ssh/.unique_host_keys"
ensureProperty $ scriptProperty ensureProperty $ scriptProperty
[ "DPKG_MAINTSCRIPT_NAME=postinst DPKG_MAINTSCRIPT_PACKAGE=openssh-server /var/lib/dpkg/info/openssh-server.postinst configure" ] [ "DPKG_MAINTSCRIPT_NAME=postinst DPKG_MAINTSCRIPT_PACKAGE=openssh-server /var/lib/dpkg/info/openssh-server.postinst configure" ]
-- | Sets all types of ssh host keys from the privdata. -- | When a host has a well-known public key, this can be used to indicate
-- what the key is. It does not cause the key to be installed.
pubKey :: String -> Property
pubKey k = pureInfoProperty ("ssh pubkey known") $
mempty { _sshPubKey = Val k }
getPubKey :: Propellor (Maybe String)
getPubKey = askInfo _sshPubKey
-- | Installs all commonly used types of ssh host keys from the privdata.
hostKeys :: IsContext c => c -> Property hostKeys :: IsContext c => c -> Property
hostKeys ctx = propertyList "known ssh host keys" hostKeys ctx = propertyList "known ssh host keys"
[ hostKey SshDsa ctx [ hostKey SshDsa ctx
@ -87,7 +97,7 @@ hostKeys ctx = propertyList "known ssh host keys"
, hostKey SshEcdsa ctx , hostKey SshEcdsa ctx
] ]
-- | Sets a single ssh host key from the privdata. -- | Installs a single ssh host key from the privdata.
hostKey :: IsContext c => SshKeyType -> c -> Property hostKey :: IsContext c => SshKeyType -> c -> Property
hostKey keytype context = combineProperties desc hostKey keytype context = combineProperties desc
[ installkey (keysrc ".pub" (SshPubKey keytype "")) (install writeFile ".pub") [ installkey (keysrc ".pub" (SshPubKey keytype "")) (install writeFile ".pub")
@ -140,10 +150,11 @@ fromKeyType SshDsa = "dsa"
fromKeyType SshEcdsa = "ecdsa" fromKeyType SshEcdsa = "ecdsa"
fromKeyType SshEd25519 = "ed25519" fromKeyType SshEd25519 = "ed25519"
-- | Puts some host's ssh public key into the known_hosts file for a user. -- | Puts some host's ssh public key, as set using 'pubKey',
-- into the known_hosts file for a user.
knownHost :: [Host] -> HostName -> UserName -> Property knownHost :: [Host] -> HostName -> UserName -> Property
knownHost hosts hn user = property desc $ knownHost hosts hn user = property desc $
go =<< fromHost hosts hn getSshPubKey go =<< fromHost hosts hn getPubKey
where where
desc = user ++ " knows ssh key for " ++ hn desc = user ++ " knows ssh key for " ++ hn
go (Just (Just k)) = do go (Just (Just k)) = do