diff options
| author | Dmitry Ilvokhin <d@ilvokhin.com> | 2024-02-04 14:06:13 +0000 |
|---|---|---|
| committer | Dmitry Ilvokhin <d@ilvokhin.com> | 2024-02-04 14:06:13 +0000 |
| commit | e10b784369bb4c20fc39bfb779a1ed5206a806d2 (patch) | |
| tree | f12a87cce2ecfbfc069cf6d8ff3719a62dcc54cf /roles/git/tasks | |
| parent | ec041892d10b6b5a055446591d8eef52b2f0b84b (diff) | |
| download | infra-e10b784369bb4c20fc39bfb779a1ed5206a806d2.tar.gz infra-e10b784369bb4c20fc39bfb779a1ed5206a806d2.tar.bz2 infra-e10b784369bb4c20fc39bfb779a1ed5206a806d2.zip | |
Add known_hosts file to verify github.com hosts
Diffstat (limited to 'roles/git/tasks')
| -rw-r--r-- | roles/git/tasks/main.yml | 31 |
1 files changed, 21 insertions, 10 deletions
diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml index c491f68..432f796 100644 --- a/roles/git/tasks/main.yml +++ b/roles/git/tasks/main.yml @@ -10,6 +10,14 @@ shell: /usr/bin/git-shell home: /srv/git +- name: Setup SSH directory for Git + ansible.builtin.file: + path: /srv/git/.ssh + state: directory + owner: git + group: git + mode: u+rw,g-w,o-rwx + - name: Update authorized_keys for Git ansible.posix.authorized_key: user: git @@ -21,14 +29,6 @@ with_fileglob: - misc/pubkeys/*.pub -- name: Setup SSH directory for Git - ansible.builtin.file: - path: /srv/git/.ssh - state: directory - owner: git - group: git - mode: u+rw,g-w,o-rwx - # Private key is required to mirror repositories to GitHub. - name: Copy private key for Git ansible.builtin.copy: @@ -38,13 +38,24 @@ group: git mode: u+rw,g-rwx,o-rwx +# We need to know github.com ssh keys before pushing there, otherwise +# post-receive will fail asking to verify authenticity of host. +# Run `ssh-keyscan github.com` to re-generate keys if required. +- name: Copy known_hosts for Git + ansible.builtin.copy: + src: files/known_hosts + dest: /srv/git/.ssh/known_hosts + owner: git + group: git + mode: u+rw,g-rwx,o-rwx + - name: Setup git-shell-commands directory ansible.builtin.file: path: /srv/git/git-shell-commands state: directory owner: git group: git - mode: u+rwx,g-w,o-rwx + mode: u+rwx,g+r,o+rx - name: Copy no-interactive-login command ansible.builtin.copy: @@ -52,7 +63,7 @@ dest: /srv/git/git-shell-commands owner: git group: git - mode: u+rwx,g+rwx,o-rwx + mode: u+rwx,g+r,o+r - name: Enable git-daemon ansible.builtin.service: |