bcherb2
a001406a33
A disposable ubuntu container, a fake private tier and a fake bootstrap endpoint, so the whole documented path — chezmoi init --apply, dotup pick, dotup private, cmp apply, dotsecrets — can run end to end without touching a real machine or a real credential. The fake tier mirrors the real one's structure (seven secrets and one alias) because dotsecrets is copied verbatim and the "8 exports, not 7" assertion depends on that cardinality; its ids are sequential and obviously synthetic. check-verbatim.sh keeps the fake tier's copies of shipped files honest, and snapshot.sh records file modes so a 644 where a 600 belongs is a diff.
58 lines
2.1 KiB
Cheetah
58 lines
2.1 KiB
Cheetah
{{- $wan := get . "giteaWanSsh" | trimPrefix "ssh://git@" | trimSuffix "/" -}}
|
|
{{- $lan := get . "giteaLanSsh" | trimPrefix "ssh://git@" | trimSuffix "/" -}}
|
|
{{- $wanParts := $wan | splitList ":" -}}
|
|
{{- $lanParts := $lan | splitList ":" -}}
|
|
{{- $wanHost := $wanParts | first -}}
|
|
{{- $lanHost := $lanParts | first -}}
|
|
{{- $wanPort := ternary ($wanParts | last) "22" (gt (len $wanParts) 1) -}}
|
|
{{- $lanPort := ternary ($lanParts | last) "22" (gt (len $lanParts) 1) -}}
|
|
# ~/.ssh/config -- PRIVATE tier. Mode 600.
|
|
#
|
|
# HOST ALIASES ONLY. No key material of any kind travels in this repository,
|
|
# in this tier or any other. Q3 is answered "sync public keys, not private":
|
|
#
|
|
# travels ~/.ssh/config, ~/.ssh/authorized_keys, ~/.ssh/pubkeys/*.pub
|
|
# never id_ed25519, id_rsa, *.pem, anything without a .pub suffix
|
|
#
|
|
# The IdentityFile lines below name a key this machine generates for itself:
|
|
#
|
|
# ssh-keygen -t ed25519 -C "$(whoami)@$(hostname)"
|
|
#
|
|
# then paste ~/.ssh/id_ed25519.pub into GitHub and Gitea once. Ninety seconds
|
|
# per machine, and a private key never crosses a network. .chezmoiignore denies
|
|
# everything under .ssh/ by default and re-includes exactly three things, so a
|
|
# key generated tomorrow cannot be swept in by a careless `chezmoi add ~/.ssh`.
|
|
|
|
Host *
|
|
AddKeysToAgent yes
|
|
ServerAliveInterval 60
|
|
ServerAliveCountMax 3
|
|
HashKnownHosts no
|
|
|
|
Host github.com
|
|
HostName github.com
|
|
User git
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
IdentitiesOnly yes
|
|
{{ if $wanHost }}
|
|
# Gitea over the WAN. A real hostname behind a real certificate; reachable
|
|
# from any network, which is what makes it the primary for both repos.
|
|
Host gitea {{ $wanHost }}
|
|
HostName {{ $wanHost }}
|
|
Port {{ $wanPort }}
|
|
User git
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
IdentitiesOnly yes
|
|
{{ end }}
|
|
{{- if $lanHost }}
|
|
# The same Gitea, reached over the LAN on a different port. Faster at home and
|
|
# the only route if the WAN name is down. A bare address on a private network:
|
|
# the single most obviously non-public line in this whole system.
|
|
Host gitea-lan {{ $lanHost }}
|
|
HostName {{ $lanHost }}
|
|
Port {{ $lanPort }}
|
|
User git
|
|
IdentityFile ~/.ssh/id_ed25519
|
|
IdentitiesOnly yes
|
|
{{ end }}
|