Compare commits

..
Author SHA1 Message Date
Zebreus
fb5c5dca78 Build of the Astro site (4d6900c on astro)
Generated with npm run build. The source is on the astro branch.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
2026-10-25 02:46:07 +01:00
29 changed files with 404 additions and 5802 deletions

3
.gitignore vendored
View file

@ -1,3 +0,0 @@
node_modules/
dist/
.astro/

View file

@ -1,21 +0,0 @@
import { defineConfig } from 'astro/config';
export default defineConfig({
// Relative asset URLs, so the site works wherever it is hosted, e.g. https://berlin.ccc.de/kik/
build: { format: 'file', assetsPrefix: '.', inlineStylesheets: 'never' },
compressHTML: false,
vite: {
// The pages' styles, which Astro bundles while building the pages, readable rather than minified
build: { cssMinify: false, rolldownOptions: { output: { assetFileNames: 'styles.css' } } },
environments: {
client: {
build: {
rolldownOptions: {
// The page's script and the terminal it loads
output: { entryFileNames: 'loader.js', chunkFileNames: 'terminal.js' },
},
},
},
},
},
});

64
coc-en.html Normal file
View file

@ -0,0 +1,64 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Code of Conduct - Khaos im Kiez</title>
<link rel="icon" type="image/png" href="logo.png">
<link rel="alternate" hreflang="de" href="coc.html">
<link rel="stylesheet" href="./styles.css"></head>
<body>
<main class="term">
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># cat CODE_OF_CONDUCT.en</p>
<nav aria-label="Navigation">
<a href="en.html">&lt;- back</a>
<a class="lang" href="coc.html" hreflang="de">[DE]</a>
</nav>
<section>
<h2>Code of Conduct</h2>
<p>
Khaos im Kiez is an event of the Chaos Computer Club Berlin e.V. (CCCB).
To make everyone feel comfortable, these rules apply to all attendees,
speakers and helpers.
</p>
<ul class="out">
<li><b>Be nice to each other.</b> Treat each other respectfully and kindly, even when you disagree.</li>
<li><b>No discrimination.</b> Racism, sexism, queerphobia, ableism and other hateful attitudes have no place here.</li>
<li><b>No harassment.</b> This includes insults, threats, stalking, unwanted physical contact and unwanted sexual attention. No means no.</li>
<li><b>Ask before taking pictures.</b> Photos, video and audio recordings of people only with their consent. This also applies to talks and workshops.</li>
<li><b>Respect devices and property.</b> Do not touch other people's devices without permission. Treat the rooms and furniture with care.</li>
<li><b>Be curious, not intrusive.</b> Chaos yes, crossing boundaries no.</li>
</ul>
<p>
<b>House rules:</b> The organizers have the right to exclude people from
the premises (Hausrecht). In case of violations they may issue warnings, ask
people to leave, or ban them from the event. Follow the
organizers' instructions.
</p>
<p>
<b>Problems?</b> If something happens to you or you notice something, talk
to a member of the organizing team or write to
aprl [at] berlin [dot] ccc [dot] de. Reports are treated confidentially.
</p>
</section>
<footer>
<a href="en.html">Home</a> &middot;
<a href="https://berlin.ccc.de/page/impressum/">Legal notice</a>
</footer>
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># <input id="term-input" aria-label="Terminal" autocomplete="off" autocapitalize="off" spellcheck="false" enterkeyhint="send"><span class="cursor"></span></p>
<script type="module" src="./loader.js"></script>
</main>
</body>
</html>

64
coc.html Normal file
View file

@ -0,0 +1,64 @@
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Code of Conduct - Khaos im Kiez</title>
<link rel="icon" type="image/png" href="logo.png">
<link rel="alternate" hreflang="en" href="coc-en.html">
<link rel="stylesheet" href="./styles.css"></head>
<body>
<main class="term">
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># cat CODE_OF_CONDUCT</p>
<nav aria-label="Navigation">
<a href="index.html">&lt;- zur&uuml;ck</a>
<a class="lang" href="coc-en.html" hreflang="en">[EN]</a>
</nav>
<section>
<h2>Code of Conduct</h2>
<p>
Khaos im Kiez ist eine Veranstaltung des Chaos Computer Club Berlin e.V.
(CCCB). Damit sich alle wohlf&uuml;hlen, gelten diese Regeln f&uuml;r alle Teilnehmenden,
Vortragenden und Helfenden.
</p>
<ul class="out">
<li><b>Sei nett zueinander.</b> Geh respektvoll und freundlich miteinander um, auch wenn du anderer Meinung bist.</li>
<li><b>Keine Diskriminierung.</b> Rassismus, Sexismus, Queerfeindlichkeit, Ableismus und andere menschenverachtende Haltungen haben hier keinen Platz.</li>
<li><b>Keine Belästigung.</b> Dazu geh&ouml;ren Beleidigungen, Bedrohungen, Stalking, unerw&uuml;nschte k&ouml;rperliche Ber&uuml;hrungen und unerw&uuml;nschte sexuelle Aufmerksamkeit. Ein Nein ist ein Nein.</li>
<li><b>Frag vor dem Fotografieren.</b> Fotos, Video- und Tonaufnahmen von Personen nur mit deren Einverst&auml;ndnis. Das gilt auch f&uuml;r Talks und Workshops.</li>
<li><b>Achte auf Ger&auml;te und Eigentum.</b> Fass fremde Ger&auml;te nicht ohne Erlaubnis an. Geh pfleglich mit den R&auml;umen und dem Inventar um.</li>
<li><b>Sei neugierig, nicht &uuml;bergriffig.</b> Chaos ja, Grenzen&uuml;berschreitungen nein.</li>
</ul>
<p>
<b>Hausrecht:</b> Die Orga hat Hausrecht. Bei Verst&ouml;&szlig;en gegen diese Regeln
kann sie Verwarnungen aussprechen, Personen der Veranstaltung verweisen
oder ein Hausverbot erteilen. Den Anweisungen der Orga ist Folge
zu leisten.
</p>
<p>
<b>Probleme?</b> Wenn dir etwas passiert oder du etwas beobachtest, sprich
eine Person aus der Orga an oder schreib an
aprl [at] berlin [dot] ccc [dot] de. Hinweise werden vertraulich behandelt.
</p>
</section>
<footer>
<a href="index.html">Startseite</a> &middot;
<a href="https://berlin.ccc.de/page/impressum/">Impressum</a>
</footer>
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># <input id="term-input" aria-label="Terminal" autocomplete="off" autocapitalize="off" spellcheck="false" enterkeyhint="send"><span class="cursor"></span></p>
<script type="module" src="./loader.js"></script>
</main>
</body>
</html>

112
en.html Normal file
View file

@ -0,0 +1,112 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Khaos im Kiez</title>
<meta name="description" content="Khaos im Kiez - a small CCC Berlin event, 28-29 November 2026, Marienstraße 11, Berlin.">
<link rel="icon" type="image/png" href="logo.png">
<link rel="alternate" hreflang="de" href="index.html">
<link rel="stylesheet" href="./styles.css"></head>
<body>
<main class="term">
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># cat README.en</p>
<header>
<img src="logo.png" alt="KiK logo: red star with keyboard and the letters kik" width="150" height="150">
<div>
<h1>Khaos<br>im <span>Kiez</span></h1>
<p class="tagline">CCC Berlin &middot; 2026-11-28 &ndash; 2026-11-29</p>
</div>
</header>
<nav aria-label="Navigation">
<a href="#infos">[1] Info</a>
<a href="#join">[2] Join in</a>
<a href="#getting-here">[3] Getting here</a>
<a class="lang" href="index.html" hreflang="de">[DE]</a>
</nav>
<section id="infos">
<h2>1 Info</h2>
<p>
Khaos im Kiez is a small chaos event, back to the roots: inspired by other
small chaos events. A weekend to chill and to experience the side of chaos
events that often gets no time at larger events.
</p>
<p>
Give a talk or workshop, work on your projects, hack together, solder,
tinker, or simply drop by, listen and meet people. Everyone who brings a
love of $things, curiosity and a bit of chaos is welcome.
</p>
<dl class="kv">
<dt>What</dt> <dd>Khaos im Kiez (KiK)</dd>
<dt>When</dt> <dd>Sat 2026-11-28 &ndash; Sun 2026-11-29, 11:00 &ndash; 23:59</dd>
<dt>Where</dt> <dd>Marienstra&szlig;e 11, 10117 Berlin, Germany</dd>
<dt>Who</dt> <dd>Chaos Computer Club Berlin</dd>
<dt>Price</dt> <dd>&euro;0.00 (ticket still required, ~50 seats)</dd>
<dt>Schedule</dt> <dd><a href="https://cfp.berlin.ccc.de">cfp.berlin.ccc.de</a></dd>
<dt>Food</dt> <dd>Eternal breakfast, vegan</dd>
<dt>Accessibility</dt> <dd>Not accessible.</dd>
<dt>Rules</dt> <dd><a href="coc-en.html">Code of Conduct</a></dd>
</dl>
</section>
<section id="join">
<h2>2 Join in</h2>
<p>
<b>Ticket:</b> Register via the ticket shop. The ticket is free, but seats
are limited.
</p>
<p>
<a class="btn hot" href="https://tickets.berlin.ccc.de/cccb/kik-v0.1/">Get ticket</a>
</p>
<p>
<b>Talks &amp; workshops:</b> Submit your proposal via the call for
participation and check the schedule later.
</p>
<p>
<a class="btn" href="https://cfp.berlin.ccc.de/kik-v01/cfp">Submit a talk</a>
<a class="btn" href="https://cfp.berlin.ccc.de/kik-v01/schedule">Schedule</a>
</p>
<p>
<b>Other:</b> Want to help otherwise or have questions? Write to
aprl [at] berlin [dot] ccc [dot] de.
</p>
</section>
<section id="getting-here">
<h2>3 Getting here</h2>
<dl class="kv">
<dt>Address</dt> <dd>Club rooms in the back yard of Marienstra&szlig;e 11, 10117 Berlin</dd>
<dt>Coordinates</dt> <dd>52.52194&deg; N, 13.38261&deg; E</dd>
<dt>Bicycle</dt> <dd>A limited number of bike racks are in the courtyard. Many bicycle streets lead there, preferably use those, e.g. with <a href="http://www.bbbike.de/">BBBike.de</a>.</dd>
<dt>Local transit</dt> <dd>The club is right next to S+U Friedrichstra&szlig;e (regional trains stop there too). From the elevated S-Bahn platform (S3/S5/S7) take the Schiffbauerdamm exit and walk across the Spree beneath the railway bridge. Albrechtstra&szlig;e leads to Marienstra&szlig;e.</dd>
<dt>Long distance</dt> <dd>Get off at Berlin Hauptbahnhof, then take any S-Bahn or regional train eastbound one stop to Friedrichstra&szlig;e. Leave the station towards the Spree, cross the footbridge and follow Albrechtstra&szlig;e to the dead-end Marienstra&szlig;e.</dd>
<dt>Air</dt> <dd>BER: Airport Express (RE7, RB14) or S9 to Friedrichstra&szlig;e, or FEX to Hauptbahnhof (then as above). Note: Terminal 5 (formerly SXF) is not connected to the rest of BER, only the S9 runs there. Strausberg airfield (EDAY): S7 direct to Friedrichstra&szlig;e.</dd>
<dt>Car</dt> <dd>Access from Hauptbahnhof or Brandenburger Tor via Luisenstra&szlig;e. From Friedrichstra&szlig;e either via Schiffbauerdamm and Albrechtstra&szlig;e (outdoor seating and cobblestones) or via Reinhardstra&szlig;e and Luisenstra&szlig;e (Albrechtstra&szlig;e is one-way the other direction).</dd>
<dt>Parking</dt> <dd>Warning: parking is scarce, and Marienstra&szlig;e and all surrounding streets are subject to paid parking zones.</dd>
</dl>
<p>
<a href="https://www.openstreetmap.org/node/3872556357#map=20/52.5217003/13.3828041&amp;layers=H">[ Map (OpenStreetMap) ]</a>
</p>
</section>
<footer>
<a href="https://berlin.ccc.de/page/impressum/">Legal notice</a> &middot;
<a href="https://berlin.ccc.de/">CCC Berlin</a>
</footer>
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># <input id="term-input" aria-label="Terminal" autocomplete="off" autocapitalize="off" spellcheck="false" enterkeyhint="send"><span class="cursor"></span></p>
<script type="module" src="./loader.js"></script>
</main>
</body>
</html>

116
index.html Normal file
View file

@ -0,0 +1,116 @@
<!DOCTYPE html>
<html lang="de">
<head>
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>Khaos im Kiez</title>
<meta name="description" content="Khaos im Kiez - kleine Chaos-Veranstaltung des CCC Berlin, 28.-29. November 2026, Marienstraße 11, Berlin.">
<link rel="icon" type="image/png" href="logo.png">
<link rel="alternate" hreflang="en" href="en.html">
<link rel="stylesheet" href="./styles.css"></head>
<body>
<main class="term">
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># cat README</p>
<header>
<img src="logo.png" alt="KiK-Logo: roter Stern mit Tastatur und den Buchstaben kik" width="150" height="150">
<div>
<h1>Khaos<br>im <span>Kiez</span></h1>
<p class="tagline">CCC Berlin &middot; 28. &ndash; 29.11.2026</p>
</div>
</header>
<nav aria-label="Navigation">
<a href="#infos">[1] Infos</a>
<a href="#mitmachen">[2] Mitmachen</a>
<a href="#anfahrt">[3] Anfahrt</a>
<a class="lang" href="en.html" hreflang="en">[EN]</a>
</nav>
<section id="infos">
<h2>1 Infos</h2>
<p>
Khaos im Kiez ist ein kleines Chaos-Event, back to the roots: inspiriert von
anderen kleinen Chaos-Events. Ein Wochenende zum Chillen und um die Seite
von Chaos-Events zu erleben, f&uuml;r die bei gr&ouml;&szlig;eren Events oft keine Zeit
mehr bleibt.
</p>
<p>
Du kannst einen Talk oder Workshop halten, an deinen Projekten schrauben,
gemeinsam hacken, l&ouml;ten, basteln oder einfach vorbeikommen, zuh&ouml;ren und
Leute kennenlernen. Alle sind willkommen, die Lust auf $Dinge, Neugier und
Chaos mitbringen.
</p>
<dl class="kv">
<dt>Was</dt> <dd>Khaos im Kiez (KiK)</dd>
<dt>Wann</dt> <dd>Sa 28.11. &ndash; So 29.11.2026, 11:00 &ndash; 23:59</dd>
<dt>Wo</dt> <dd>Marienstra&szlig;e 11, 10117 Berlin</dd>
<dt>Wer</dt> <dd>Chaos Computer Club Berlin</dd>
<dt>Preis</dt> <dd>0,00 &euro; (Ticket trotzdem n&ouml;tig, ~50 Pl&auml;tze)</dd>
<dt>Fahrplan</dt> <dd><a href="https://cfp.berlin.ccc.de">cfp.berlin.ccc.de</a></dd>
<dt>Essen</dt> <dd>Ewiges Fr&uuml;hst&uuml;ck, vegan</dd>
<dt>Barrierefrei</dt> <dd>Nicht barrierefrei.</dd>
<dt>Regeln</dt> <dd><a href="coc.html">Code of Conduct</a></dd>
</dl>
</section>
<section id="mitmachen">
<h2>2 Mitmachen</h2>
<p>
<b>Ticket:</b> Anmeldung &uuml;ber den Ticketshop. Das Ticket ist kostenlos,
aber die Pl&auml;tze sind begrenzt.
</p>
<p>
<a class="btn hot" href="https://tickets.berlin.ccc.de/cccb/kik-v0.1/">Ticket sichern</a>
</p>
<p>
<b>Talks &amp; Workshops:</b> Reiche deinen Beitrag im Call for Participation ein
und schau dir sp&auml;ter den Fahrplan an.
</p>
<p>
<a class="btn" href="https://cfp.berlin.ccc.de/kik-v01/cfp">Talk einreichen</a>
<a class="btn" href="https://cfp.berlin.ccc.de/kik-v01/schedule">Fahrplan</a>
</p>
<p>
<b>Sonstiges:</b> Du willst anders helfen oder hast Fragen? Schreib an
aprl [at] berlin [dot] ccc [dot] de.
</p>
</section>
<section id="anfahrt">
<h2>3 Anfahrt</h2>
<dl class="kv">
<dt>Adresse</dt> <dd>Clubr&auml;ume im Hinterhof der Marienstra&szlig;e 11, 10117 Berlin</dd>
<dt>Koordinaten</dt> <dd>52,52194&deg; N, 13,38261&deg; O</dd>
<dt>Fahrrad</dt> <dd>Im Innenhof gibt es eine begrenzte Zahl an Fahrradst&auml;ndern. Auf dem Weg liegen viele Fahrradstra&szlig;en, nutz die am besten, z.&nbsp;B. mit <a href="http://www.bbbike.de/">BBBike.de</a>.</dd>
<dt>&Ouml;PNV</dt> <dd>Der Club liegt direkt beim S+U-Bahnhof Friedrichstra&szlig;e (auch Regionalbahnen). Vom oberirdischen S-Bahn-Steig (S3/S5/S7) nimmst du den Ausgang Schiffbauerdamm und gehst unter der Bahnbr&uuml;cke &uuml;ber die Spree. &Uuml;ber die Albrechtstra&szlig;e kommst du zur Marienstra&szlig;e.</dd>
<dt>Fernverkehr</dt> <dd>Aussteigen in Berlin Hauptbahnhof, dann mit S-Bahn oder Regionalbahn Richtung Osten eine Station bis Friedrichstra&szlig;e. Bahnhof Richtung Spree verlassen, &uuml;ber die Fu&szlig;g&auml;ngerbr&uuml;cke und der Albrechtstra&szlig;e bis zur Stichstra&szlig;e Marienstra&szlig;e folgen.</dd>
<dt>Flugzeug</dt> <dd>BER: Airport Express (RE7, RB14) oder S9 bis Friedrichstra&szlig;e, alternativ FEX bis Hauptbahnhof (dann wie Fernverkehr). Achtung: Terminal 5 (fr&uuml;her SXF) ist nicht mit dem Rest des BER verbunden, dort f&auml;hrt nur die S9. Flugplatz Strausberg (EDAY): S7 direkt bis Friedrichstra&szlig;e.</dd>
<dt>Auto</dt> <dd>Zufahrt von Hauptbahnhof oder Brandenburger Tor &uuml;ber die Luisenstra&szlig;e. Von der Friedrichstra&szlig;e entweder &uuml;ber Schiffbauerdamm und Albrechtstra&szlig;e (Au&szlig;engastronomie und Kopfsteinpflaster) oder &uuml;ber Reinhardstra&szlig;e und Luisenstra&szlig;e (die Albrechtstra&szlig;e ist nur in Gegenrichtung befahrbar).</dd>
<dt>Parken</dt> <dd>Achtung: Es gibt kaum Parkpl&auml;tze, und die Marienstra&szlig;e und alle umliegenden Stra&szlig;en sind parkraumbewirtschaftet.</dd>
</dl>
<p>
<a href="https://www.openstreetmap.org/node/3872556357#map=20/52.5217003/13.3828041&amp;layers=H">[ Karte (OpenStreetMap) ]</a>
</p>
</section>
<footer>
<p>
<a href="https://berlin.ccc.de/page/impressum/">Impressum</a> &middot;
<a href="https://berlin.ccc.de/">CCC Berlin</a>
</p>
</footer>
<p class="prompt">root@khaos-im-kiez:<span class="cwd">~</span># <input id="term-input" aria-label="Terminal" autocomplete="off" autocapitalize="off" spellcheck="false" enterkeyhint="send"><span class="cursor"></span></p>
<script type="module" src="./loader.js"></script>
</main>
</body>
</html>

1
loader.js Normal file
View file

@ -0,0 +1 @@
var e=(function(){let e=typeof document<`u`&&document.createElement(`link`).relList;return e&&e.supports&&e.supports(`modulepreload`)?`modulepreload`:`preload`})(),t=function(e,t){return new URL(e,t).href},n={},r=function(e){return e.pathname.endsWith(`.css`)},i=function(e,t,n){if(t in e)return e[t];let r=n();if(!r){e[t]=void 0;return}let i=r.then(()=>{e[t]=void 0},n=>{throw e[t]=void 0,n});return e[t]=i,i},a=function(a,o,s){let c=Promise.resolve();if(o&&o.length>0){let a,l=document.querySelector(`meta[property=csp-nonce]`),u=l?.nonce||l?.getAttribute(`nonce`);function d(e){return Promise.all(e.map(e=>Promise.resolve(e).then(e=>({status:`fulfilled`,value:e}),e=>({status:`rejected`,reason:e}))))}function f(e){return import.meta.resolve?new URL(import.meta.resolve(e)):new URL(e,import.meta.url)}c=d(o.map(o=>{o=t(o,s);let c=f(o),l=r(c);return i(n,c.href,()=>{if(a===void 0){a={all:new Set,styles:new Set};let e=document.getElementsByTagName(`link`);for(let t=e.length-1;t>=0;t--){let n=e[t];a.all.add(n.href),n.rel===`stylesheet`&&a.styles.add(n.href)}}if((l?a.styles:a.all).has(c.href))return;let t=document.createElement(`link`);if(t.rel=l?`stylesheet`:e,l||(t.as=`script`),t.crossOrigin=``,t.href=c.href,u&&t.setAttribute(`nonce`,u),document.head.appendChild(t),l)return new Promise((e,n)=>{t.addEventListener(`load`,e),t.addEventListener(`error`,()=>n(Error(`Unable to preload CSS for ${c}`)))})})}).filter(e=>e!==void 0))}function l(e){let t=new Event(`vite:preloadError`,{cancelable:!0});if(t.payload=e,window.dispatchEvent(t),!t.defaultPrevented)throw e}return c.then(e=>{for(let t of e||[])t.status===`rejected`&&l(t.reason);return a().catch(l)})},o=document.getElementById(`term-input`),s=o.parentElement,c;addEventListener(`keydown`,e=>{if(!(e.target!==document.body||e.key.length!==1||e.key===` `||e.metaKey||e.ctrlKey!==e.altKey)){if(!c)return o.focus();e.preventDefault(),c.focus(),c.input(e.key)}}),s.addEventListener(`click`,()=>o.focus()),o.addEventListener(`input`,()=>o.style.width=`${o.value.length}ch`),o.addEventListener(`keydown`,e=>{if(e.key!==`Enter`||e.isComposing)return;e.preventDefault();let t=o.value;o.replaceWith(t),s.querySelector(`.cursor`).remove(),a(async()=>{let{start:e}=await import(`./terminal.js`);return{start:e}},[],import.meta.url).then(({start:e})=>e(s,t)).then(e=>c=e).catch(e=>s.append(` [${e.message}]`))});

BIN
logo.png Normal file

Binary file not shown.

After

Width:  |  Height:  |  Size: 123 KiB

3716
package-lock.json generated

File diff suppressed because it is too large Load diff

View file

@ -1,18 +0,0 @@
{
"name": "kik-website",
"type": "module",
"private": true,
"scripts": {
"dev": "astro dev",
"build": "astro build",
"preview": "astro preview"
},
"dependencies": {
"@noble/ciphers": "^2.4.0",
"@noble/curves": "^2.4.0",
"@noble/hashes": "^2.4.0",
"@xterm/addon-web-links": "^0.12.0",
"@xterm/xterm": "^6.0.0",
"astro": "^7.4.2"
}
}

View file

@ -1,114 +0,0 @@
# The shell server
The website's terminal connects to a shell server, whose `root` user logs in at `wss://web.nowhere.wirs.ing` and
gets a shell on the box.
## The security model
The box is an isolated, disposable VPS at a random hoster. We assume that it can be compromised and that this is
acceptable: the worst case is that the gimmick on the website stops working. Nothing else is on the box. The
website and the websocket bridge that carries the connection run on other servers, so a compromised shell server
cannot get at them.
The `root` user on the box is a normal Windows account without administrator rights. It may do a lot of things
there, including things we did not plan for. We do not try to contain it and we do not try to undo what it does.
We only keep the basic user journey working.
## What we keep working
Anything that breaks the following user journey is not acceptable:
- The user can connect with the SSH key as `root`.
- The prompt: `root@khaos-im-kiez:~#`, which `~/.zsh/.zshrc` sets.
- The home directory the user ends up in: `/home/root`. They cannot change where it is, and they cannot delete it.
- `cat README`, `cat README.en`, `cat CODE_OF_CONDUCT` and `cat CODE_OF_CONDUCT.en` always work. The four files
are always there and always regular text files.
So in summary running `ssh root@nowhere.wirs.ing cat README` must always succeed and display the contents of the file.
Anything thats not specified above (like the content of README for example) is NOT part of the user journey.
## What we do not keep working
As long as the user story above does not break, we do not guarantee the functionality of anything else on the server. However the cleanup task should still try to best-effort restore everything to a working condition.
## Packages
The root user owns the whole MSYS2 installation and can install packages with pacman. That means they can also
replace or delete the very programs the login needs. So the sshd, the login shell `zsh` and `cat` are kept as a
second, protected copy in `C:\msys2\opt\kik`, which only SYSTEM and the administrators may write. The sshd runs as
SYSTEM from that copy and the login shell is that copy's `zsh`, with `/opt/kik` first on the path, so the journey
keeps working no matter what the user does to their own `/usr/bin`. Replacing `/usr/bin/sshd` cannot touch the
running server, so the key on the website still never grants administrator access.
The copy has to be the *same* MSYS2 installation, not a second one: `C:\msys2\opt\kik` is two levels below
`C:\msys2`, so its runtime resolves the same root and the login shell and the user's own tools share one cygwin
runtime. A separate installation does not work - two runtimes in one process tree corrupt each other's file
descriptors and pacman cannot even lock its database.
The runtime itself is not among the protected copies. A program and the shell that starts it have to use the same
runtime DLL, or the program does not run at all - a second copy of it in one process is refused. The login path
therefore uses the one in `/usr/bin`, next to the user's own programs, and the user may replace and upgrade it.
What is protected instead is that it is the one the package says it is: pacman checks the files of `msys2-runtime`,
and the cleanup job puts the package back if it was changed - while the server is stopped, before it starts it
again, because the server runs as SYSTEM and would otherwise run code the user of the website wrote.
`/etc/passwd` (the login shell and home directory) and `/etc/ssh` (the host keys and config) are read-only to the
user as well; everything else in the installation is theirs.
## The cleanup tasks
Three scheduled tasks run as SYSTEM, all at startup, and the user cannot stop any of them:
- `KiK sshd` runs the sshd from `C:\msys2\opt\kik`. It replaces the installation's own `msys2-sshd` service, which
is disabled.
- `KiK restore shell files` runs every 30 minutes and rebuilds the protected copy from its trusted originals,
re-applies the permissions, and puts the home directory, the shell configuration, the website's key and the four
texts back. Its second job is to best-effort revert other mockery and bring a fresh server to the expected state.
- `KiK watch the server` runs every two minutes and starts the server when nothing listens on port 22. The task of
the server only starts it again when it failed, never when it was stopped, so a cleanup job that is killed while
it has the server stopped would otherwise take the site down with it.
The cleanup job only restarts the server when it has to: when it does not listen at all, when it is older than its
configuration, or when the protected copy or the runtime has to be repaired - those cannot be replaced while the
server holds them open. A working server is left alone, because every start can fail, and failed starts have kept
the site down for hours. The job also never restarts the server while somebody is connected: a session that is open
keeps the port, so a server that is started then could not bind it.
The server is only down for the short part of the job that needs it down: the protected copy cannot be replaced
while the server holds it open. Everything else - the home directory, the four texts, the permissions of the
installation - is put back while the server runs, because on a slow disk that takes minutes and the site should
have a shell the whole time.
The task that runs the server ignores a start while it thinks it is still running, so a start that is dropped
leaves the site without a shell. The cleanup job therefore tries three times, killing the processes of the task
in between, before it gives up.
The deployment does not restart the server. It runs in a session, and that session keeps the port, so a server that
starts during a deployment cannot bind it. The new configuration and the restored programs therefore take effect
at the next run of the cleanup job, which happens within half an hour.
The server logs to `C:\ProgramData\kik-restore\sshd.log`. The log is appended to, not overwritten, because it is
the only trace of what the server did: a server that is restarted would otherwise take the evidence of an outage
with it. It is rotated when it grows past a hundred megabytes, which takes years. The event logs of windows are
made bigger as well, the security log to a gigabyte: the scanners of the remote desktop alone fill a hundred
megabytes of it in a week.
A start of the server that fails leaves nothing in that log. So windows records the history of the scheduled tasks
and the start and end of every process, and when the server does not come up, the cleanup job writes the processes
and the state of the server's task to `C:\ProgramData\kik-restore\failed-starts.log`.
Only keys may log in over SSH. The box stands in the open internet and both of its accounts have a password.
The files that have to stay belong to the administrators, so the user cannot delete them, and they cannot change the
shell configuration or the key the website logs in with either. The shell reads its configuration from `~/.zsh`, so
the startup files the user could write in the home directory are ignored.
## Installing the cleanup on the server
To deploy the cleanup task an the server, run:
server/scripts/deploy.sh
The script logs in as `Administrator` - whose shell is a Windows one - copies the scripts and the resources to the
Administrator's home directory and runs the installer there.

View file

@ -1 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBTHzLm8QMhHIo7kFAvtAFnqpspeR3L3gM8kLoG1137 lennart@erms

View file

@ -1,2 +0,0 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJDweEH8bhZAHVaAedhTVDb2j/oMEn3vm97xCwCw9LC9 root@nowhere.wirs.ing cygwin-2222
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIBTHzLm8QMhHIo7kFAvtAFnqpspeR3L3gM8kLoG1137 lennart@erms

View file

@ -1,40 +0,0 @@
# The protected copies of zsh and cat (and the server itself) live here; keeping them first means the basic
# journey - the prompt and reading the four texts - survives even if the user breaks their own /usr/bin copies.
path=(/opt/kik $path)
# History shared between sessions.
HISTFILE=~/.zsh_history HISTSIZE=10000 SAVEHIST=10000
setopt share_history hist_ignore_dups hist_ignore_space interactive_comments auto_cd
# Completion: menu, case-insensitive, colored. -C skips compaudit, which is slow on
# Windows and meaningless under MSYS2's noacl mounts (rm ~/.zcompdump after adding completions).
autoload -Uz compinit && compinit -C
zstyle ':completion:*' menu select
zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}'
zstyle ':completion:*' list-colors ${(s.:.)LS_COLORS}
# Emacs keys; Up/Down search history for what is already typed.
bindkey -e
autoload -Uz up-line-or-beginning-search down-line-or-beginning-search
zle -N up-line-or-beginning-search && zle -N down-line-or-beginning-search
bindkey '^[[A' up-line-or-beginning-search '^[OA' up-line-or-beginning-search
bindkey '^[[B' down-line-or-beginning-search '^[OB' down-line-or-beginning-search
# Prompt: user@host:directory, git branch, exit status of the last command if it failed.
# A literal '#' as on Linux: zsh's %# would show '%', since this root is not uid 0.
# The branch is read from .git/HEAD directly: starting git on every prompt is slow on Windows.
precmd() {
local d=$PWD head=
until [[ -e $d/.git || $d == / ]]; do d=${d:h}; done
[[ -f $d/.git/HEAD ]] && read -r head < $d/.git/HEAD
[[ $head == 'ref: '* ]] && git_branch=${head#ref: refs/heads/} || git_branch=${head:0:7}
print -Pn '\e]0;%n@%m: %~\a'
}
setopt prompt_subst
PROMPT='%F{green}%n@%m%f:%F{blue}%~%f${git_branch:+ %5F($git_branch)%f}%(?.. %F{red}[%?]%f)# '
alias ls='ls --color=auto' ll='ls -lah' grep='grep --color=auto'
# Process monitor: htop does not exist for MSYS2 (its /proc only shows MSYS2 processes).
# bottom is a native Windows program; winpty lets it draw in the pty, as Server 2016 has no ConPTY.
alias btm='winpty /ucrt64/bin/btm'

View file

@ -1,7 +0,0 @@
# Preset what MSYS2's /etc/profile would otherwise start a helper process for (~90 ms each here).
# TZ has to match the Windows timezone (W. Europe Standard Time).
export LANG=en_US.UTF-8 TZ=Europe/Berlin
# The shell reads its configuration from here, not from the home directory: the user may not change it, and the
# files in the home directory that zsh would read otherwise (.zprofile, .zlogin) are ignored.
export ZDOTDIR=~/.zsh

View file

@ -1,31 +0,0 @@
┌─┤ Code of Conduct ├────────────────────────────────────────────────────────────┐
│ Khaos im Kiez ist eine Veranstaltung des Chaos Computer Club Berlin e.V. │
│ (CCCB). Damit sich alle wohlfühlen, gelten diese Regeln für alle │
│ Teilnehmenden, Vortragenden und Helfenden. │
│ │
│ > Sei nett zueinander. Geh respektvoll und freundlich miteinander um, auch │
│ wenn du anderer Meinung bist. │
│ > Keine Diskriminierung. Rassismus, Sexismus, Queerfeindlichkeit, Ableismus │
│ und andere menschenverachtende Haltungen haben hier keinen Platz. │
│ > Keine Belästigung. Dazu gehören Beleidigungen, Bedrohungen, Stalking, │
│ unerwünschte körperliche Berührungen und unerwünschte sexuelle │
│ Aufmerksamkeit. Ein Nein ist ein Nein. │
│ > Frag vor dem Fotografieren. Fotos, Video- und Tonaufnahmen von Personen nur │
│ mit deren Einverständnis. Das gilt auch für Talks und Workshops. │
│ > Achte auf Geräte und Eigentum. Fass fremde Geräte nicht ohne Erlaubnis an. │
│ Geh pfleglich mit den Räumen und dem Inventar um. │
│ > Sei neugierig, nicht übergriffig. Chaos ja, Grenzenüberschreitungen nein. │
│ │
│ Hausrecht: Die Orga hat Hausrecht. Bei Verstößen gegen diese Regeln kann sie │
│ Verwarnungen aussprechen, Personen der Veranstaltung verweisen oder ein │
│ Hausverbot erteilen. Den Anweisungen der Orga ist Folge zu leisten. │
│ │
│ Probleme? Wenn dir etwas passiert oder du etwas beobachtest, sprich eine │
│ Person aus der Orga an oder schreib an aprl [at] berlin [dot] ccc [dot] de. │
│ Hinweise werden vertraulich behandelt. │
└────────────────────────────────────────────────────────────────────────────────┘
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/kik/\Startseite]8;;\ · ]8;;https://berlin.ccc.de/page/impressum/\Impressum]8;;\

View file

@ -1,30 +0,0 @@
┌─┤ Code of Conduct ├────────────────────────────────────────────────────────────┐
│ Khaos im Kiez is an event of the Chaos Computer Club Berlin e.V. (CCCB). To │
│ make everyone feel comfortable, these rules apply to all attendees, speakers │
│ and helpers. │
│ │
│ > Be nice to each other. Treat each other respectfully and kindly, even when │
│ you disagree. │
│ > No discrimination. Racism, sexism, queerphobia, ableism and other hateful │
│ attitudes have no place here. │
│ > No harassment. This includes insults, threats, stalking, unwanted physical │
│ contact and unwanted sexual attention. No means no. │
│ > Ask before taking pictures. Photos, video and audio recordings of people │
│ only with their consent. This also applies to talks and workshops. │
│ > Respect devices and property. Do not touch other people's devices without │
│ permission. Treat the rooms and furniture with care. │
│ > Be curious, not intrusive. Chaos yes, crossing boundaries no. │
│ │
│ House rules: The organizers have the right to exclude people from the premises │
│ (Hausrecht). In case of violations they may issue warnings, ask people to │
│ leave, or ban them from the event. Follow the organizers' instructions. │
│ │
│ Problems? If something happens to you or you notice something, talk to a │
│ member of the organizing team or write to aprl [at] berlin [dot] ccc [dot] de. │
│ Reports are treated confidentially. │
└────────────────────────────────────────────────────────────────────────────────┘
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/kik/en.html\Home]8;;\ · ]8;;https://berlin.ccc.de/page/impressum/\Legal notice]8;;\

View file

@ -1,79 +0,0 @@
KHAOS IM KIEZ
CCC Berlin · 28. – 29.11.2026
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/kik/#infos\[1] Infos]8;;\ ]8;;https://berlin.ccc.de/kik/#mitmachen\[2] Mitmachen]8;;\ ]8;;https://berlin.ccc.de/kik/#anfahrt\[3] Anfahrt]8;;\
──────────────────────────────────────────────────────────────────────────────────
┌─┤ 1 Infos ├────────────────────────────────────────────────────────────────────┐
│ Khaos im Kiez ist ein kleines Chaos-Event, back to the roots: inspiriert von │
│ anderen kleinen Chaos-Events. Ein Wochenende zum Chillen und um die Seite von │
│ Chaos-Events zu erleben, für die bei größeren Events oft keine Zeit mehr │
│ bleibt. │
│ │
│ Du kannst einen Talk oder Workshop halten, an deinen Projekten schrauben, │
│ gemeinsam hacken, löten, basteln oder einfach vorbeikommen, zuhören und Leute │
│ kennenlernen. Alle sind willkommen, die Lust auf $Dinge, Neugier und Chaos │
│ mitbringen. │
│ │
│ Was : Khaos im Kiez (KiK) │
│ Wann : Sa 28.11. – So 29.11.2026, 11:00 – 23:59 │
│ Wo : Marienstraße 11, 10117 Berlin │
│ Wer : Chaos Computer Club Berlin │
│ Preis : 0,00 € (Ticket trotzdem nötig, ~50 Plätze) │
│ Fahrplan : ]8;;https://cfp.berlin.ccc.de\cfp.berlin.ccc.de]8;;\ │
│ Essen : Ewiges Frühstück, vegan │
│ Barrierefrei : Nicht barrierefrei. │
│ Regeln : ]8;;https://berlin.ccc.de/kik/coc.html\Code of Conduct]8;;\ │
└────────────────────────────────────────────────────────────────────────────────┘
┌─┤ 2 Mitmachen ├────────────────────────────────────────────────────────────────┐
│ Ticket: Anmeldung über den Ticketshop. Das Ticket ist kostenlos, aber die │
│ Plätze sind begrenzt. │
│ │
│ ]8;;https://tickets.berlin.ccc.de/cccb/kik-v0.1/\[ Ticket sichern ]]8;;\ │
│ │
│ Talks & Workshops: Reiche deinen Beitrag im Call for Participation ein und │
│ schau dir später den Fahrplan an. │
│ │
│ ]8;;https://cfp.berlin.ccc.de/kik-v01/cfp\[ Talk einreichen ]]8;;\ ]8;;https://cfp.berlin.ccc.de/kik-v01/schedule\[ Fahrplan ]]8;;\ │
│ │
│ Sonstiges: Du willst anders helfen oder hast Fragen? Schreib an aprl [at] │
│ berlin [dot] ccc [dot] de. │
└────────────────────────────────────────────────────────────────────────────────┘
┌─┤ 3 Anfahrt ├──────────────────────────────────────────────────────────────────┐
│ Adresse : Clubräume im Hinterhof der Marienstraße 11, 10117 Berlin │
│ Koordinaten : 52,52194° N, 13,38261° O │
│ Fahrrad : Im Innenhof gibt es eine begrenzte Zahl an Fahrradständern. Auf │
│ dem Weg liegen viele Fahrradstraßen, nutz die am besten, z. B. │
│ mit ]8;;http://www.bbbike.de/\BBBike.de]8;;\. │
│ ÖPNV : Der Club liegt direkt beim S+U-Bahnhof Friedrichstraße (auch │
│ Regionalbahnen). Vom oberirdischen S-Bahn-Steig (S3/S5/S7) │
│ nimmst du den Ausgang Schiffbauerdamm und gehst unter der │
│ Bahnbrücke über die Spree. Über die Albrechtstraße kommst du │
│ zur Marienstraße. │
│ Fernverkehr : Aussteigen in Berlin Hauptbahnhof, dann mit S-Bahn oder │
│ Regionalbahn Richtung Osten eine Station bis Friedrichstraße. │
│ Bahnhof Richtung Spree verlassen, über die Fußgängerbrücke und │
│ der Albrechtstraße bis zur Stichstraße Marienstraße folgen. │
│ Flugzeug : BER: Airport Express (RE7, RB14) oder S9 bis Friedrichstraße, │
│ alternativ FEX bis Hauptbahnhof (dann wie Fernverkehr). │
│ Achtung: Terminal 5 (früher SXF) ist nicht mit dem Rest des BER │
│ verbunden, dort fährt nur die S9. Flugplatz Strausberg (EDAY): │
│ S7 direkt bis Friedrichstraße. │
│ Auto : Zufahrt von Hauptbahnhof oder Brandenburger Tor über die │
│ Luisenstraße. Von der Friedrichstraße entweder über │
│ Schiffbauerdamm und Albrechtstraße (Außengastronomie und │
│ Kopfsteinpflaster) oder über Reinhardstraße und Luisenstraße │
│ (die Albrechtstraße ist nur in Gegenrichtung befahrbar). │
│ Parken : Achtung: Es gibt kaum Parkplätze, und die Marienstraße und alle │
│ umliegenden Straßen sind parkraumbewirtschaftet. │
│ │
│ ]8;;https://www.openstreetmap.org/node/3872556357#map=20/52.5217003/13.3828041&layers=H\[ Karte (OpenStreetMap) ]]8;;\ │
└────────────────────────────────────────────────────────────────────────────────┘
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/page/impressum/\Impressum]8;;\ · ]8;;https://berlin.ccc.de/\CCC Berlin]8;;\

View file

@ -1,77 +0,0 @@
KHAOS IM KIEZ
CCC Berlin · 2026-11-28 – 2026-11-29
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/kik/en.html#infos\[1] Info]8;;\ ]8;;https://berlin.ccc.de/kik/en.html#join\[2] Join in]8;;\ ]8;;https://berlin.ccc.de/kik/en.html#getting-here\[3] Getting here]8;;\
──────────────────────────────────────────────────────────────────────────────────
┌─┤ 1 Info ├─────────────────────────────────────────────────────────────────────┐
│ Khaos im Kiez is a small chaos event, back to the roots: inspired by other │
│ small chaos events. A weekend to chill and to experience the side of chaos │
│ events that often gets no time at larger events. │
│ │
│ Give a talk or workshop, work on your projects, hack together, solder, tinker, │
│ or simply drop by, listen and meet people. Everyone who brings a love of │
│ $things, curiosity and a bit of chaos is welcome. │
│ │
│ What : Khaos im Kiez (KiK) │
│ When : Sat 2026-11-28 – Sun 2026-11-29, 11:00 – 23:59 │
│ Where : Marienstraße 11, 10117 Berlin, Germany │
│ Who : Chaos Computer Club Berlin │
│ Price : €0.00 (ticket still required, ~50 seats) │
│ Schedule : ]8;;https://cfp.berlin.ccc.de\cfp.berlin.ccc.de]8;;\ │
│ Food : Eternal breakfast, vegan │
│ Accessibility : Not accessible. │
│ Rules : ]8;;https://berlin.ccc.de/kik/coc-en.html\Code of Conduct]8;;\ │
└────────────────────────────────────────────────────────────────────────────────┘
┌─┤ 2 Join in ├──────────────────────────────────────────────────────────────────┐
│ Ticket: Register via the ticket shop. The ticket is free, but seats are │
│ limited. │
│ │
│ ]8;;https://tickets.berlin.ccc.de/cccb/kik-v0.1/\[ Get ticket ]]8;;\ │
│ │
│ Talks & workshops: Submit your proposal via the call for participation and │
│ check the schedule later. │
│ │
│ ]8;;https://cfp.berlin.ccc.de/kik-v01/cfp\[ Submit a talk ]]8;;\ ]8;;https://cfp.berlin.ccc.de/kik-v01/schedule\[ Schedule ]]8;;\ │
│ │
│ Other: Want to help otherwise or have questions? Write to aprl [at] berlin │
│ [dot] ccc [dot] de. │
└────────────────────────────────────────────────────────────────────────────────┘
┌─┤ 3 Getting here ├─────────────────────────────────────────────────────────────┐
│ Address : Club rooms in the back yard of Marienstraße 11, 10117 Berlin │
│ Coordinates : 52.52194° N, 13.38261° E │
│ Bicycle : A limited number of bike racks are in the courtyard. Many │
│ bicycle streets lead there, preferably use those, e.g. with │
│ ]8;;http://www.bbbike.de/\BBBike.de]8;;\. │
│ Local transit : The club is right next to S+U Friedrichstraße (regional trains │
│ stop there too). From the elevated S-Bahn platform (S3/S5/S7) │
│ take the Schiffbauerdamm exit and walk across the Spree │
│ beneath the railway bridge. Albrechtstraße leads to │
│ Marienstraße. │
│ Long distance : Get off at Berlin Hauptbahnhof, then take any S-Bahn or │
│ regional train eastbound one stop to Friedrichstraße. Leave │
│ the station towards the Spree, cross the footbridge and follow │
│ Albrechtstraße to the dead-end Marienstraße. │
│ Air : BER: Airport Express (RE7, RB14) or S9 to Friedrichstraße, or │
│ FEX to Hauptbahnhof (then as above). Note: Terminal 5 │
│ (formerly SXF) is not connected to the rest of BER, only the │
│ S9 runs there. Strausberg airfield (EDAY): S7 direct to │
│ Friedrichstraße. │
│ Car : Access from Hauptbahnhof or Brandenburger Tor via │
│ Luisenstraße. From Friedrichstraße either via Schiffbauerdamm │
│ and Albrechtstraße (outdoor seating and cobblestones) or via │
│ Reinhardstraße and Luisenstraße (Albrechtstraße is one-way the │
│ other direction). │
│ Parking : Warning: parking is scarce, and Marienstraße and all │
│ surrounding streets are subject to paid parking zones. │
│ │
│ ]8;;https://www.openstreetmap.org/node/3872556357#map=20/52.5217003/13.3828041&layers=H\[ Map (OpenStreetMap) ]]8;;\ │
└────────────────────────────────────────────────────────────────────────────────┘
──────────────────────────────────────────────────────────────────────────────────
]8;;https://berlin.ccc.de/page/impressum/\Legal notice]8;;\ · ]8;;https://berlin.ccc.de/\CCC Berlin]8;;\

View file

@ -1,67 +0,0 @@
#!/usr/bin/env bash
# Deploys the cleanup job to the shell server and installs it there.
#
# server/scripts/deploy.sh [-i KEYFILE] [-h HOST] [--uninstall]
#
# The job runs on the box as SYSTEM, never as the root user. The Administrator account sets it up; its shell is a
# Windows one, so the commands we run there are Windows commands.
#
# The Administrator logs in with the personal key of the deployer, from the agent or from -i. The key of the website
# never gets administrator rights: it only logs in as the root user.
set -euo pipefail
HOST=nowhere.wirs.ing
USER=Administrator
KEYFILE=''
UNINSTALL=0
while [ $# -gt 0 ]; do
case $1 in
-i) KEYFILE=$2; shift 2 ;;
-h) HOST=$2; shift 2 ;;
--uninstall) UNINSTALL=1; shift ;;
*) echo "usage: $(basename "$0") [-i KEYFILE] [-h HOST] [--uninstall]" >&2; exit 2 ;;
esac
done
repo=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
server="$repo/server"
remote='C:\Users\Administrator\kik' # where the installer is put, in the home of the Administrator
remotePath='/c/Users\Administrator\kik' # the same place, as the file transfer sees it
temporary=()
# The host key is the one the website pins, so that the deployment cannot be intercepted.
expected=$(sed -n "s/.*const HOST_KEY = '\([^']*\)'.*/\1/p" "$repo/src/scripts/terminal.ts")
known=$(mktemp)
temporary+=("$known")
trap 'rm -f "${temporary[@]}"' EXIT
ssh-keyscan -t ed25519 "$HOST" > "$known" 2>/dev/null
actual=$(ssh-keygen -lf "$known" | awk '{print $2}')
if [ "$actual" != "$expected" ]; then
echo "the host key of $HOST is $actual, but $expected is expected" >&2
exit 1
fi
# The site logs in with the first key in the authorized_keys of the user on the box, so it has to be the right one.
sitekey=$(ssh-keygen -lf "$server/resources/home/.ssh/authorized_keys" | awk 'NR==1 {print $2}')
if [ "$sitekey" != 'SHA256:KUEv4d4+75h41l0OGTWCA2FbtEOQZ047ujkeh+kkFW0' ]; then
echo "the key of the website is not the first one in server/resources/home/.ssh/authorized_keys" >&2
exit 1
fi
options=(-o "UserKnownHostsFile=$known" -o StrictHostKeyChecking=yes)
if [ -n "$KEYFILE" ]; then options+=(-i "$KEYFILE"); fi
ssh=(ssh "${options[@]}" "$USER@$HOST")
scp=(scp "${options[@]}")
if [ "$UNINSTALL" = 1 ]; then
"${ssh[@]}" "if exist $remote\\scripts\\install_restore_task.ps1 (powershell -NoProfile -ExecutionPolicy Bypass -File $remote\\scripts\\install_restore_task.ps1 -Uninstall) else (echo Nothing is installed.)"
exit
fi
# The installer looks for the resources next to itself, so both directories go to the server. What was there
# before is removed, so that files that are gone from the repository do not stay on the box.
"${ssh[@]}" "if exist $remote rmdir /s /q $remote"
"${ssh[@]}" "mkdir $remote"
"${scp[@]}" -r "$server/scripts" "$server/resources" "$USER@$HOST:$remotePath/"
"${ssh[@]}" "powershell -NoProfile -ExecutionPolicy Bypass -File $remote\\scripts\\install_restore_task.ps1"

Some files were not shown because too many files have changed in this diff Show more