server/secrets/ssh, branch main Unnamed repository; edit this file 'description' to name the repository. http://euandre.org/git/server/atom?h=main 2020-08-10T15:53:57Z Remove unused secrets/{borg,ssh}/ 2020-08-10T15:53:57Z EuAndreh eu@euandre.org 2020-08-10T15:53:57Z urn:sha1:95038613f5c775c8b46b015a0bace04280286254 Migration: Remove Ansible and Docker code, move only to NixOS 2020-08-10T15:45:43Z EuAndreh eu@euandre.org 2020-08-10T15:15:49Z urn:sha1:100ab568e3aeb512e86fd1155a73454d22e24895 Generate UserKnownHostsFile dynamically instead of when rotating keys 2019-06-08T14:43:38Z EuAndreh eu@euandre.org 2019-06-08T14:43:38Z urn:sha1:f054e9dea98bf56c8ea068dc279e99e76a334848 The previous solution would hardcode the server IP. This way we can change the server IP address that is hosting everything and keep the SSH keypair. Previously changing the IP address would require either calling the =./rotate-ssh-keys.sh= script or manually changing the IP address on the known-hosts.txt file. The IP address being duplicated itself was a code smell. Both SSH keypair and IP address can now be changed independently. Script: rotate SSH keys 2019-06-05T22:44:12Z EuAndreh eu@euandre.org 2019-06-05T22:44:12Z urn:sha1:5ef193b08008903e1f2cac4f89b84963975f4150 Script: rotate SSH keys 2019-06-05T22:37:40Z EuAndreh eu@euandre.org 2019-06-05T22:37:40Z urn:sha1:bc426ca3e3d9c1a10786ea54f44877affb3faeec Script: rotate SSH keys 2019-06-05T22:27:26Z EuAndreh eu@euandre.org 2019-06-05T22:27:26Z urn:sha1:fd205c2b81edb09819dece00c05a7fc2bf8b35ea Fix git-crypt configuration 2019-06-05T22:25:05Z EuAndreh eu@euandre.org 2019-06-05T22:23:59Z urn:sha1:b5195ce90b7357a4b963861f62343ac26adc0e1a Use known-hosts.txt with public key from the rotated SSH key pair 2019-06-05T21:02:35Z EuAndreh eu@euandre.org 2019-06-05T21:02:35Z urn:sha1:4681d2ed280e751317158b4855ac30a7efb9970f Use Ansible instead of Bash for provisioning 2019-06-05T19:42:06Z EuAndreh eu@euandre.org 2019-06-05T19:38:53Z urn:sha1:54fd61c887f266f8e2e6b1419a86fc6681116069 The deployment is not quite working, and I'm unable to test right now: DigitalOcean is returning 503 for my requests. As of this commit, I can run =ansible-playbook provider.yml= more than once and it will actually be idempotent. Notes: - SSH fingerprint are now taken from the public key file instead of manually supplying it in the terraform template using the =digitalocean_ssh_key= resource; - use Ansible instead of ad-hoc Bash scripts for provisioning the Droplets created by Terraform; - use the =filename.env.extension= to create the concrete files in CI; - use the =user_data= to add the know SSH key pair to the newly created Droplet; - add =rotate-ssh-keys.sh= utils;