cccb-website-team/kik-website
Watch
0
0
Fork
You've already forked kik-website
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Install the key of the deployer for both accounts

Browse source 
The personal key of the deployer goes into the authorized_keys of the
root user together with the key of the website, and the deployment makes
sure it is in the authorized_keys of the Administrator.

Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
Zebreus 2026-10-25 13:52:32 +01:00
commit 44a2d83ae6
1 changed files with 30 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

16
server/README.md
View file

@ -22,7 +22,8 @@ We only keep the basic user journey working.
- `cat README`, `cat README.en`, `cat CODE_OF_CONDUCT` and `cat CODE_OF_CONDUCT.en` always work. The four files
are always there and always regular text files.
- The website can log in: the key it uses is in `~/.ssh/authorized_keys`. That key gets access to the `root` user
only, never to the Administrator account, whose keys belong to the people who deploy.
only, never to the Administrator account. The keys of the people who deploy - their own key, not the key of the
website - are in the authorized_keys of both accounts.
Modifying the four files is allowed; the next cleanup undoes it. Deleting them is not permanent either.
@ -61,8 +62,9 @@ undoes that.
## This directory
- `home/` - the files that belong in the home directory of the user: `~/.zshrc`, `~/.zshenv` and the key in
`~/.ssh/authorized_keys` that the website logs in with. This is where they are edited.
- `home/` - the files that belong in the home directory of the user: `~/.zshrc`, `~/.zshenv` and the keys in
`~/.ssh/authorized_keys` - the one the website logs in with and the ones of the people who deploy. This is where
they are edited.
- `resources/` - the copies the cleanup restores from: the four text files and the files of `home/`.
- `scripts/make_files.py` - builds the resources.
- `scripts/deploy.sh` - deploys the cleanup to the server and installs it.
@ -78,10 +80,10 @@ The resources are built from the website's pages and the files of `home/`:
server/scripts/deploy.sh
The script logs in as `Administrator` - whose shell is a Windows one - copies the scripts and the resources to the
Administrator's home directory and runs the installer there. It logs in with the personal key of the deployer, from
the agent or from `-i`; the key of the website never gets administrator rights, it only logs in as the root user.
It checks the host key against the one the website pins, and checks that the key in `home/.ssh/authorized_keys` is
the one the website uses. `--uninstall` removes the task again.
Administrator's home directory and runs the installer there. It logs in with the personal key of the deployer,
`~/.ssh/id_ed25519` by default and `-i` for another one; the key of the website never gets administrator rights, it
only logs in as the root user. It checks the host key against the one the website pins, and checks that the key in
`home/.ssh/authorized_keys` is the one the website uses. `--uninstall` removes the task again.
The installer can also be run by hand, in an elevated PowerShell on the server: