infra/codestorage/hg-ssh: pullkeys.sh diff

Pull hostkeys when pulling SSH keys. Rather than relying on Kubernetes secrets and baking public keys right in, which was bound to get fraught, we now have some graceful degradation. It defaults to automatically-generated random keys, but will try to download some keys from Google Cloud Storage for the host. If it can find some, it'll try to use those, instead.

     1.1 --- a/pullkeys.sh	Thu Oct 15 00:14:32 2015 -0700
     1.2 +++ b/pullkeys.sh	Thu Oct 15 01:32:28 2015 -0700
     1.3 @@ -1,11 +1,14 @@
     1.4  #!/bin/bash
     1.5  DOMAIN=${DOMAIN:-code.secondbit.org}
     1.6  SSH_KEYS_BUCKET=${SSH_KEYS_BUCKET:-sshkeys.$DOMAIN}
     1.7 +SSH_HOST_KEYS_BUCKET=${SSH_HOST_KEYS_BUCKET:-hostkeys.$DOMAIN}
     1.8  
     1.9  mkdir -p /tmp/sshkeys
    1.10 +mkdir -p /tmp/hostkeys
    1.11  
    1.12  echo "Cleaning up..."
    1.13  rm -rf /tmp/sshkeys/*
    1.14 +rm -rf /tmp/hostkeys/*
    1.15  
    1.16  echo "Downloading keys from gs://${SSH_KEYS_BUCKET}/"
    1.17  
    1.18 @@ -33,7 +36,27 @@
    1.19  	fi
    1.20  done
    1.21  
    1.22 +echo "Downloading host keys from gs://${SSH_HOST_KEYS_BUCKET}/"
    1.23 +
    1.24 +output=$(gsutil cp -R gs://$SSH_HOST_KEYS_BUCKET/\* /tmp/hostkeys/ 2>&1)
    1.25 +echo $output
    1.26 +
    1.27 +keys=/tmp/hostkeys/*
    1.28 +
    1.29 +for key in $keys
    1.30 +do
    1.31 +	if [[ $key != *".pub" ]]
    1.32 +	then
    1.33 +		chmod 0700 $key
    1.34 +	fi
    1.35 +	target="/etc/ssh/${key##*/}"
    1.36 +	echo "Moving $key to $target"
    1.37 +	rm $target
    1.38 +	mv $key $target
    1.39 +done
    1.40 +
    1.41  echo "Cleaning up..."
    1.42  rm -rf /tmp/sshkeys/*
    1.43 +rm -rf /tmp/hostkeys/*
    1.44  
    1.45  echo "SSH key pull complete."

infra/codestorage/hg-ssh

infra/codestorage/hg-ssh/pullkeys.sh