titaniumtown/server-config
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

security: harden CI pipeline (pin host keys, suppress ntfy topic, restrict secrets)
Some checks failed
Build and Deploy / deploy (push) Failing after 2m33s

Browse Source
This commit is contained in:
Simon Gardling
2026-03-31 11:03:07 -04:00
parent c556b82f9a
commit 40fa8147e6
4 changed files with 16 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
.gitea/workflows/deploy.yml
View File

@@ -7,7 +7,7 @@ jobs:
deploy: deploy:
runs-on: nix runs-on: nix
env: env:
GIT_SSH_COMMAND: "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=no" GIT_SSH_COMMAND: "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
steps: steps:
- uses: https://github.com/actions/checkout@v4 - uses: https://github.com/actions/checkout@v4
with: with:
@@ -25,12 +25,12 @@ jobs:
run: | run: |
eval $(ssh-agent -s) eval $(ssh-agent -s)
ssh-add /run/agenix/ci-deploy-key ssh-add /run/agenix/ci-deploy-key
nix run github:serokell/deploy-rs -- .#muffin --skip-checks --ssh-opts="-o StrictHostKeyChecking=no" nix run github:serokell/deploy-rs -- .#muffin --skip-checks --ssh-opts="-o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts"
- name: Health check - name: Health check
run: | run: |
sleep 10 sleep 10
ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=no root@server-public \ ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts root@server-public \
"systemctl is-active gitea && systemctl is-active caddy && systemctl is-active continuwuity && systemctl is-active coturn" "systemctl is-active gitea && systemctl is-active caddy && systemctl is-active continuwuity && systemctl is-active coturn"
- name: Notify success - name: Notify success
@@ -38,7 +38,7 @@ jobs:
run: | run: |
TOPIC=$(cat /run/agenix/ntfy-alerts-topic | tr -d '[:space:]') TOPIC=$(cat /run/agenix/ntfy-alerts-topic | tr -d '[:space:]')
TOKEN=$(cat /run/agenix/ntfy-alerts-token | tr -d '[:space:]') TOKEN=$(cat /run/agenix/ntfy-alerts-token | tr -d '[:space:]')
curl -sf -X POST \ curl -sf -o /dev/null -X POST \
"https://ntfy.sigkill.computer/$TOPIC" \ "https://ntfy.sigkill.computer/$TOPIC" \
-H "Authorization: Bearer $TOKEN" \ -H "Authorization: Bearer $TOKEN" \
-H "Title: [muffin] Deploy succeeded" \ -H "Title: [muffin] Deploy succeeded" \
@@ -51,7 +51,7 @@ jobs:
run: | run: |
TOPIC=$(cat /run/agenix/ntfy-alerts-topic 2>/dev/null | tr -d '[:space:]') TOPIC=$(cat /run/agenix/ntfy-alerts-topic 2>/dev/null | tr -d '[:space:]')
TOKEN=$(cat /run/agenix/ntfy-alerts-token 2>/dev/null | tr -d '[:space:]') TOKEN=$(cat /run/agenix/ntfy-alerts-token 2>/dev/null | tr -d '[:space:]')
curl -sf -X POST \ curl -sf -o /dev/null -X POST \
"https://ntfy.sigkill.computer/$TOPIC" \ "https://ntfy.sigkill.computer/$TOPIC" \
-H "Authorization: Bearer $TOKEN" \ -H "Authorization: Bearer $TOKEN" \
-H "Title: [muffin] Deploy FAILED" \ -H "Title: [muffin] Deploy FAILED" \

8
configuration.nix
View File

@@ -79,6 +79,14 @@
networking.hosts."192.168.1.50" = [ "server-public" ]; networking.hosts."192.168.1.50" = [ "server-public" ];
networking.hosts."192.168.1.223" = [ "desktop" ]; networking.hosts."192.168.1.223" = [ "desktop" ];
# SSH known_hosts for CI runner (pinned host keys)
environment.etc."ci-known-hosts".text = ''
server-public ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
192.168.1.50 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
git.sigkill.computer ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
git.gardling.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFMjgaMnE+zS7tL+m5E7gh9Q9U1zurLdmU0qcmEmaucu
'';
services.kmscon.enable = true; services.kmscon.enable = true;
systemd.targets = { systemd.targets = {

4
modules/age-secrets.nix
View File

@@ -140,8 +140,8 @@
git-crypt-key-dotfiles = { git-crypt-key-dotfiles = {
file = ../secrets/git-crypt-key-dotfiles.age; file = ../secrets/git-crypt-key-dotfiles.age;
mode = "0400"; mode = "0400";
owner = "gitea-runner"; owner = "root";
group = "gitea-runner"; group = "root";
}; };
# Git-crypt symmetric key for server-config repo # Git-crypt symmetric key for server-config repo

2
services/gitea-actions-runner.nix
View File

@@ -41,6 +41,6 @@
User = "gitea-runner"; User = "gitea-runner";
Group = "gitea-runner"; Group = "gitea-runner";
}; };
environment.GIT_SSH_COMMAND = "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=no"; environment.GIT_SSH_COMMAND = "ssh -i /run/agenix/ci-deploy-key -o StrictHostKeyChecking=yes -o UserKnownHostsFile=/etc/ci-known-hosts";
}; };
} }