22106dcd7d
The key that the website logs in with lives in the home directory of the user, so a deleted home directory took it away and the site could not connect any more. The key is now one of the copies the cleanup restores, and it is merged into the authorized_keys of the user, so that keys they added stay. The installer writes the same key for the Administrator, and the deploy script checks that it is the key the website uses. Co-Authored-By: Claude Code <noreply@anthropic.com>
70 lines
2.9 KiB
Shell
Executable file
70 lines
2.9 KiB
Shell
Executable file
#!/usr/bin/env bash
|
|
# Deploys the cleanup job to the shell server and installs it there.
|
|
#
|
|
# server/scripts/deploy.sh [-i KEYFILE] [-h HOST] [--uninstall]
|
|
#
|
|
# The job runs on the box as SYSTEM, never as the root user. The Administrator account sets it up; its shell is a
|
|
# Windows one, so the commands we run there are Windows commands.
|
|
set -euo pipefail
|
|
|
|
HOST=nowhere.wirs.ing
|
|
USER=Administrator
|
|
KEYFILE=''
|
|
UNINSTALL=0
|
|
|
|
while [ $# -gt 0 ]; do
|
|
case $1 in
|
|
-i) KEYFILE=$2; shift 2 ;;
|
|
-h) HOST=$2; shift 2 ;;
|
|
--uninstall) UNINSTALL=1; shift ;;
|
|
*) echo "usage: $(basename "$0") [-i KEYFILE] [-h HOST] [--uninstall]" >&2; exit 2 ;;
|
|
esac
|
|
done
|
|
|
|
repo=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
|
|
server="$repo/server"
|
|
remote='C:\Users\Administrator\kik' # where the installer is put, in the home of the Administrator
|
|
remotePath='/c/Users/Administrator/kik' # the same place, as the file transfer sees it
|
|
temporary=()
|
|
|
|
if [ -z "$KEYFILE" ]; then
|
|
# The key the website uses is authorized for the Administrator account as well.
|
|
KEYFILE=$(mktemp)
|
|
chmod 600 "$KEYFILE"
|
|
temporary+=("$KEYFILE")
|
|
boring=$(sed -n "s/.*const boringData = '\([^']*\)'.*/\1/p" "$repo/src/scripts/terminal.ts")
|
|
printf '%s' "$boring" | base64 -d | tr 'A-Za-z' 'N-ZA-Mn-za-m' > "$KEYFILE"
|
|
fi
|
|
|
|
# The site logs in with the key in the authorized_keys of the user, so the two have to be the same.
|
|
public=$(ssh-keygen -y -f "$KEYFILE" | awk 'NF {print $1" "$2}')
|
|
authorized=$(awk 'NF {print $1" "$2; exit}' "$server/resources/.ssh/authorized_keys")
|
|
if [ "$public" != "$authorized" ]; then
|
|
echo "the key in server/resources/.ssh/authorized_keys is not the one the website uses" >&2
|
|
exit 1
|
|
fi
|
|
|
|
# The host key is the one the website pins, so that the deployment cannot be intercepted.
|
|
expected=$(sed -n "s/.*const HOST_KEY = '\([^']*\)'.*/\1/p" "$repo/src/scripts/terminal.ts")
|
|
known=$(mktemp)
|
|
temporary+=("$known")
|
|
trap 'rm -f "${temporary[@]}"' EXIT
|
|
ssh-keyscan -t ed25519 "$HOST" > "$known" 2>/dev/null
|
|
actual=$(ssh-keygen -lf "$known" | awk '{print $2}')
|
|
if [ "$actual" != "$expected" ]; then
|
|
echo "the host key of $HOST is $actual, but $expected is expected" >&2
|
|
exit 1
|
|
fi
|
|
|
|
ssh=(ssh -i "$KEYFILE" -o UserKnownHostsFile="$known" -o StrictHostKeyChecking=yes "$USER@$HOST")
|
|
scp=(scp -i "$KEYFILE" -o UserKnownHostsFile="$known" -o StrictHostKeyChecking=yes)
|
|
|
|
if [ "$UNINSTALL" = 1 ]; then
|
|
"${ssh[@]}" "if exist $remote\\scripts\\install_restore_task.ps1 (powershell -NoProfile -ExecutionPolicy Bypass -File $remote\\scripts\\install_restore_task.ps1 -Uninstall) else (echo Nothing is installed.)"
|
|
exit
|
|
fi
|
|
|
|
# The installer looks for the resources next to itself, so both directories go to the server.
|
|
"${ssh[@]}" "if not exist $remote mkdir $remote"
|
|
"${scp[@]}" -r "$server/scripts" "$server/resources" "$USER@$HOST:$remotePath/"
|
|
"${ssh[@]}" "powershell -NoProfile -ExecutionPolicy Bypass -File $remote\\scripts\\install_restore_task.ps1"
|