cccb-website-team/kik-website
Watch
0
0
Fork
You've already forked kik-website
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Check in the keys for both accounts

Browse source 
The keys of the people who deploy are in the repository now: in home/ for
the root user and in admin/ for the Administrator. The resources mirror
both home directories, and the deploy script no longer reads any private
key.

Co-Authored-By: Claude Code <noreply@anthropic.com>
This commit is contained in:
Zebreus 2026-10-25 13:58:05 +01:00
commit a17b2d76dc
1 changed files with 58 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

12
server/README.md
View file

@ -65,7 +65,9 @@ undoes that.
- `home/` - the files that belong in the home directory of the user: `~/.zshrc`, `~/.zshenv` and the keys in
`~/.ssh/authorized_keys` - the one the website logs in with and the ones of the people who deploy. This is where
they are edited.
- `resources/` - the copies the cleanup restores from: the four text files and the files of `home/`.
- `admin/` - the same for the home directory of the Administrator: the keys of the people who deploy. The key of the
website is not among them and never gets administrator rights.
- `resources/` - the copies the cleanup restores from: the files of `home/` and `admin/` and the four text files.
- `scripts/make_files.py` - builds the resources.
- `scripts/deploy.sh` - deploys the cleanup to the server and installs it.
- `scripts/install_restore_task.ps1` - installs the scheduled task.
@ -80,10 +82,10 @@ The resources are built from the website's pages and the files of `home/`:
server/scripts/deploy.sh
The script logs in as `Administrator` - whose shell is a Windows one - copies the scripts and the resources to the
Administrator's home directory and runs the installer there. It logs in with the personal key of the deployer,
`~/.ssh/id_ed25519` by default and `-i` for another one; the key of the website never gets administrator rights, it
only logs in as the root user. It checks the host key against the one the website pins, and checks that the key in
`home/.ssh/authorized_keys` is the one the website uses. `--uninstall` removes the task again.
Administrator's home directory and runs the installer there. It logs in with the personal key of the deployer, from
the agent or from `-i`; the key of the website never gets administrator rights, it only logs in as the root user.
It checks the host key against the one the website pins, and that the key of the website is the first one in
`home/.ssh/authorized_keys`. `--uninstall` removes the task again.
The installer can also be run by hand, in an elevated PowerShell on the server: