(feature) Generate filesystem-backed SSH credentials
Add filesystem-backed SSH credentials for the native systemd deployment path. Generated keys are stored below POBSYNC_HOME with 0600 permissions, while Django keeps the public key, fingerprint, path, and selection metadata. Add a Django SSH key generation view, delete action for unused generated keys, and a management command used by the installer to ensure a default backup key exists. Update runtime config to use generated key paths directly as IdentityFile, extend host checks to verify key readability, and keep legacy uploaded keys available for compatibility.
This commit is contained in:
@@ -11,6 +11,7 @@ from pobsync.paths import PobsyncPaths
|
||||
|
||||
from .config_repository import global_config_data, host_config_data
|
||||
from .models import GlobalConfig, HostConfig, SshCredential
|
||||
from .ssh_keys import identity_path
|
||||
|
||||
|
||||
class DjangoConfigSource:
|
||||
@@ -48,9 +49,12 @@ def _materialize_credential(credential: SshCredential) -> dict[str, str]:
|
||||
credential_dir.mkdir(mode=0o700, parents=True, exist_ok=True)
|
||||
os.chmod(credential_dir, 0o700)
|
||||
|
||||
identity_file = credential_dir / "identity"
|
||||
identity_file.write_text(_with_trailing_newline(credential.private_key), encoding="utf-8")
|
||||
os.chmod(identity_file, 0o600)
|
||||
identity_file = identity_path(credential)
|
||||
if credential.key_path:
|
||||
os.chmod(identity_file, 0o600)
|
||||
else:
|
||||
identity_file.write_text(_with_trailing_newline(credential.private_key), encoding="utf-8")
|
||||
os.chmod(identity_file, 0o600)
|
||||
|
||||
result = {"identity_file": str(identity_file)}
|
||||
if credential.known_hosts.strip():
|
||||
|
||||
Reference in New Issue
Block a user