runner: sync SSH keys from Forgejo instead of hardcoding them #3

Merged

kristofferopsahl merged 1 commit from ssh-keys-from-forgejo into main

2026-09-18 22:13:50 +02:00

kristofferopsahl commented

2026-09-18 22:13:48 +02:00

Owner

The template carried two hardcoded public keys that had gone stale — neither is on the Forgejo account any more, so a freshly provisioned runner was only reachable with old keys.

Now nothing is baked in. /usr/local/sbin/sync-ssh-keys mirrors https://git.kristofferopsahl.com/kristofferopsahl.keys into kristoffer's authorized_keys during provisioning (retried for ~5 min) and then hourly via sync-ssh-keys.timer. A failed, empty or malformed download leaves the last good file in place, so a Forgejo outage never locks anyone out.

Tested on the live ci-grantory-01 with the exact script and units from this template: failure path leaves the file untouched; a real sync yields the three keys from Forgejo; fresh login + sudo still work. Not tested: a from-scratch cloud-init provision with this template (YAML parses, script passes sh -n).

Consequence to be aware of: whoever controls the SSH keys on that Forgejo account has sudo on the runners.

🤖 Generated with Claude Code

The template carried two hardcoded public keys that had gone stale — neither is on the Forgejo account any more, so a freshly provisioned runner was only reachable with old keys. Now nothing is baked in. `/usr/local/sbin/sync-ssh-keys` mirrors `https://git.kristofferopsahl.com/kristofferopsahl.keys` into `kristoffer`'s `authorized_keys` during provisioning (retried for ~5 min) and then hourly via `sync-ssh-keys.timer`. A failed, empty or malformed download leaves the last good file in place, so a Forgejo outage never locks anyone out. **Tested** on the live `ci-grantory-01` with the exact script and units from this template: failure path leaves the file untouched; a real sync yields the three keys from Forgejo; fresh login + sudo still work. **Not tested:** a from-scratch cloud-init provision with this template (YAML parses, script passes `sh -n`). **Consequence to be aware of:** whoever controls the SSH keys on that Forgejo account has sudo on the runners. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

kristofferopsahl added 1 commit

2026-09-18 22:13:49 +02:00

runner: sync kristoffer's SSH keys from Forgejo instead of hardcoding them 12f9770de7

The template carried two hardcoded public keys that had gone stale (neither
is on the Forgejo account any more). Replace them with sync-ssh-keys: it
mirrors https://git.kristofferopsahl.com/kristofferopsahl.keys into
kristoffer's authorized_keys during provisioning and hourly via a systemd
timer. A failed, empty or malformed download keeps the last good file.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

kristofferopsahl merged commit 0467c6d8a9 into main

2026-09-18 22:13:50 +02:00

kristofferopsahl deleted branch ssh-keys-from-forgejo

2026-09-18 22:13:50 +02:00

kristofferopsahl referenced this pull request from a commit

2026-09-18 22:13:50 +02:00

runner: sync SSH keys from Forgejo instead of hardcoding them (#3)