96 lines
4.6 KiB
Python
Executable File
96 lines
4.6 KiB
Python
Executable File
#!/usr/bin/env python3
|
|
"""Bootstrap a fleet node through a trusted OpenSSH connection."""
|
|
|
|
import argparse
|
|
import json
|
|
import re
|
|
import shlex
|
|
import subprocess
|
|
import sys
|
|
from pathlib import Path
|
|
from urllib.parse import urlsplit
|
|
|
|
|
|
def repository(url):
|
|
if any(ch.isspace() or ord(ch) < 32 for ch in url):
|
|
raise ValueError("invalid repository URL")
|
|
if url.startswith("ssh://"):
|
|
parts = urlsplit(url)
|
|
if parts.password is not None or parts.query or parts.fragment:
|
|
raise ValueError("expected an SSH repository URL without password, query or fragment")
|
|
host, port, path = parts.hostname, parts.port, parts.path
|
|
else:
|
|
match = re.fullmatch(r"(?:[\w.-]+@)?(\[[\da-fA-F:]+\]|[\w.-]+):(.+)", url)
|
|
if not match:
|
|
raise ValueError("expected git@host:path or ssh://user@host[:port]/path")
|
|
host, path = match.groups()
|
|
host, port = host.strip("[]"), None
|
|
if not host or not re.fullmatch(r"[a-zA-Z0-9:][a-zA-Z0-9.:-]*", host) or not path:
|
|
raise ValueError("invalid Git host or repository path")
|
|
return f"[{host}]:{port}" if port not in (None, 22) else host, Path(path).name.removesuffix(".git")
|
|
|
|
|
|
def keygen(args, data=None):
|
|
return subprocess.run(["ssh-keygen", *args], input=data or b"", capture_output=True)
|
|
|
|
|
|
def bootstrap(args):
|
|
endpoint, basename = repository(args.repo)
|
|
name = args.node_name if args.node_name is not None else basename
|
|
if not re.fullmatch(r"[a-zA-Z0-9][a-zA-Z0-9._-]*", name):
|
|
raise ValueError("invalid node name")
|
|
operator = args.operator_key.read_text().strip()
|
|
fields = operator.split()
|
|
if (len(operator.splitlines()) != 1 or len(fields) < 2
|
|
or keygen(["-lf", "-"], (" ".join(fields[:2]) + "\n").encode()).returncode):
|
|
raise ValueError("operator key must contain one plain SSH public key")
|
|
derived = keygen(["-y", "-P", "", "-f", str(args.deploy_key.resolve())])
|
|
if derived.returncode or derived.stdout.split()[0].startswith(b"sk-"):
|
|
raise ValueError("deploy key must be a standalone private key with no passphrase and owner-only permissions")
|
|
if derived.stdout.split()[:2] == [v.encode() for v in fields[:2]]:
|
|
raise ValueError("operator and deploy keys must be different")
|
|
matches = keygen(["-F", endpoint, "-f", str(args.known_hosts.resolve())])
|
|
pins = [line for line in matches.stdout.decode().splitlines() if line and not line.startswith("#")]
|
|
if matches.returncode or not pins or not any(
|
|
not pin.startswith("@revoked ") and keygen(["-lf", "-"], (pin + "\n").encode()).returncode == 0
|
|
for pin in pins
|
|
):
|
|
raise ValueError(f"no usable known_hosts pin for {endpoint}")
|
|
payload = json.dumps(dict(operator_key=operator, deploy_key=args.deploy_key.read_text(),
|
|
known_hosts="\n".join(pins) + "\n", repo_url=args.repo, node_name=name))
|
|
helper = Path(__file__).resolve().with_name("bootstrap-node-remote.py").read_text()
|
|
# Package management must never consume the credential payload on standard input.
|
|
remote = """set -e
|
|
if [ "$(id -u)" = 0 ]; then set --; else set -- sudo -n --; fi
|
|
if ! command -v python3 >/dev/null; then
|
|
test -f /etc/debian_version
|
|
"$@" apt-get -o DPkg::Lock::Timeout=60 update </dev/null
|
|
"$@" env DEBIAN_FRONTEND=noninteractive apt-get -o DPkg::Lock::Timeout=60 install -y python3 </dev/null
|
|
fi
|
|
exec "$@" python3 -I -c """ + shlex.quote(helper)
|
|
result = subprocess.run(["ssh", "-T", "-a", "-S", "none", "-o", "StrictHostKeyChecking=yes",
|
|
"-o", "ClearAllForwardings=yes", "--", args.target, remote],
|
|
input=payload.encode())
|
|
if result.returncode == 0:
|
|
print(f"Checkout ready for adam at /srv/{name}.")
|
|
return result.returncode
|
|
|
|
|
|
def main():
|
|
parser = argparse.ArgumentParser(description=__doc__)
|
|
parser.add_argument("--target", required=True, help="trusted SSH target with root or noninteractive sudo")
|
|
parser.add_argument("--repo", required=True, help="SSH URL of the node repository")
|
|
parser.add_argument("--operator-key", required=True, type=Path, help="operator public key")
|
|
parser.add_argument("--deploy-key", required=True, type=Path, help="repository deploy private key")
|
|
parser.add_argument("--known-hosts", required=True, type=Path, help="trusted Git server host keys")
|
|
parser.add_argument("--node-name", help="defaults to repository basename without .git")
|
|
args = parser.parse_args()
|
|
try:
|
|
return bootstrap(args)
|
|
except (OSError, ValueError) as exc:
|
|
parser.exit(1, f"bootstrap-node: {exc}\n")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
sys.exit(main())
|