Repository navigation
fix: keel-overlay-installer keeps private keys out of etckeeper's /etc/.git - #50
Merged
Merged
Conversation
…c/.git etckeeper committed wireguard/wg0.key at the keel installation and mysql/keel-tls/server.key at a reinstallation (real nodes, keel 0.23.3). A rotated key stays in the history. keel-overlay-installer 0.2.0 ships /usr/lib/keel/overlays/installer/etckeeper-ignore, and its postinst runs it at each configure. The script writes a list of private key and secret paths into /etc/.gitignore, outside the section etckeeper manages, so etckeeper's init and uninit keep it. Where /etc/.git exists, it removes the tracked files of the list from the index and commits that removal with no other change. It does not rewrite the history: the changelog tells the operator to rotate each key that was tracked. tests/etckeeper-ignore.bats tests the script on a scratch git repository (100 percent of its lines). tests/overlay-install.bats tests the postinst with the real etckeeper in the CI job install, which now installs etckeeper. Closes #49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #49.
Change
keel-overlay-installer 0.2.0 ships
/usr/lib/keel/overlays/installer/etckeeper-ignore. Its postinst runs the script at each configure:/etc/.gitignore, outside the section etckeeper manages. etckeeper'sinit,update-ignoreanduninitkeep the list, also when the first boot hook92etckeepermakes the repository again./etc/.gitexists, the script removes the tracked files of the list from the index (git rm --cached). It commits that removal with the new.gitignore, and with no other change. The files stay on disk. The history is not rewritten.Paths under
/etc:wireguard/*.key,mysql/keel-tls/*.key,etcd/keel/*.key,keel/secrets/,ssl/private/,ssh/ssh_host_*_key,crowdsec/local_api_credentials.yaml,crowdsec/online_api_credentials.yaml,crowdsec/bouncers/*.yaml.local,anubis/keel.key,anubis/keel.key.*.The changelog tells the operator to rotate each key that was tracked. keel has no command that rotates a key yet: keel makes each key once, and a renewal of a certificate keeps the key.
The package is the installer overlay because every Keel appliance has it through
keel-core.Test plan
tests/etckeeper-ignore.bats: 18 tests on a scratch git repository; 37 of 37 lines (kcov 43, Debian 13).tests/coverage.sh 100passes locally.packages/build installerbuilds and lintian is clean.install:tests/overlay-install.batsinstalls etckeeper and tests the postinst with the real etckeeper (reinstall, uninit and init).