61 lines
2.1 KiB
Bash
Executable File
61 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
|
|
if [[ ${EUID} -ne 0 ]]; then
|
|
echo "Run this installer with sudo." >&2
|
|
exit 1
|
|
fi
|
|
|
|
readonly SOURCE_DIR="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
|
|
readonly PUBLIC_KEY_FILE="${1:-}"
|
|
|
|
if [[ -z ${PUBLIC_KEY_FILE} || ! -f ${PUBLIC_KEY_FILE} ]]; then
|
|
echo "Usage: $0 /path/to/gitea-runner.pub" >&2
|
|
exit 2
|
|
fi
|
|
|
|
if ! id deploy >/dev/null 2>&1; then
|
|
echo "The deploy system account does not exist." >&2
|
|
exit 3
|
|
fi
|
|
|
|
read -r key_type key_body _ <"${PUBLIC_KEY_FILE}"
|
|
if [[ ${key_type} != "ssh-ed25519" || -z ${key_body:-} ]]; then
|
|
echo "Expected an Ed25519 public key." >&2
|
|
exit 4
|
|
fi
|
|
|
|
install -o root -g root -m 0755 "${SOURCE_DIR}/eusrr-deploy" /usr/local/sbin/eusrr-deploy
|
|
install -o root -g root -m 0755 "${SOURCE_DIR}/eusrr-deploy-ssh" /usr/local/sbin/eusrr-deploy-ssh
|
|
|
|
sudoers_tmp="$(mktemp)"
|
|
trap 'rm -f "${sudoers_tmp}"' EXIT
|
|
printf '%s\n' 'deploy ALL=(root) NOPASSWD: /usr/local/sbin/eusrr-deploy *' >"${sudoers_tmp}"
|
|
chmod 0440 "${sudoers_tmp}"
|
|
visudo -cf "${sudoers_tmp}" >/dev/null
|
|
install -o root -g root -m 0440 "${sudoers_tmp}" /etc/sudoers.d/eusrr-deploy
|
|
|
|
deploy_home="$(getent passwd deploy | cut -d: -f6)"
|
|
install -d -o deploy -g deploy -m 0700 "${deploy_home}/.ssh"
|
|
authorized_keys="${deploy_home}/.ssh/authorized_keys"
|
|
touch "${authorized_keys}"
|
|
chown deploy:deploy "${authorized_keys}"
|
|
chmod 0600 "${authorized_keys}"
|
|
|
|
filtered_keys="$(mktemp)"
|
|
grep -v ' eusrr-gitea-runner$' "${authorized_keys}" >"${filtered_keys}" || true
|
|
printf '%s %s %s %s\n' \
|
|
'command="/usr/local/sbin/eusrr-deploy-ssh",restrict' \
|
|
"${key_type}" "${key_body}" 'eusrr-gitea-runner' >>"${filtered_keys}"
|
|
install -o deploy -g deploy -m 0600 "${filtered_keys}" "${authorized_keys}"
|
|
rm -f "${filtered_keys}"
|
|
|
|
install -d -o root -g root -m 0755 /var/lib/eusrr-deploy
|
|
install -d -o deploy -g deploy -m 0700 /var/backups/eusrr/deploy
|
|
touch /var/log/eusrr-deploy.log
|
|
chown root:root /var/log/eusrr-deploy.log
|
|
chmod 0600 /var/log/eusrr-deploy.log
|
|
|
|
sudo -u deploy sudo -n /usr/local/sbin/eusrr-deploy --self-test
|
|
echo "Restricted Gitea runner access installed successfully."
|