diff options
Diffstat (limited to 'roles')
| -rw-r--r-- | roles/git/files/known_hosts | 3 | ||||
| -rw-r--r-- | roles/git/tasks/main.yml | 31 |
2 files changed, 24 insertions, 10 deletions
diff --git a/roles/git/files/known_hosts b/roles/git/files/known_hosts new file mode 100644 index 0000000..5f2b86f --- /dev/null +++ b/roles/git/files/known_hosts @@ -0,0 +1,3 @@ +github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg= +github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk= +github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl diff --git a/roles/git/tasks/main.yml b/roles/git/tasks/main.yml index c491f68..432f796 100644 --- a/roles/git/tasks/main.yml +++ b/roles/git/tasks/main.yml @@ -10,6 +10,14 @@ shell: /usr/bin/git-shell home: /srv/git +- name: Setup SSH directory for Git + ansible.builtin.file: + path: /srv/git/.ssh + state: directory + owner: git + group: git + mode: u+rw,g-w,o-rwx + - name: Update authorized_keys for Git ansible.posix.authorized_key: user: git @@ -21,14 +29,6 @@ with_fileglob: - misc/pubkeys/*.pub -- name: Setup SSH directory for Git - ansible.builtin.file: - path: /srv/git/.ssh - state: directory - owner: git - group: git - mode: u+rw,g-w,o-rwx - # Private key is required to mirror repositories to GitHub. - name: Copy private key for Git ansible.builtin.copy: @@ -38,13 +38,24 @@ group: git mode: u+rw,g-rwx,o-rwx +# We need to know github.com ssh keys before pushing there, otherwise +# post-receive will fail asking to verify authenticity of host. +# Run `ssh-keyscan github.com` to re-generate keys if required. +- name: Copy known_hosts for Git + ansible.builtin.copy: + src: files/known_hosts + dest: /srv/git/.ssh/known_hosts + owner: git + group: git + mode: u+rw,g-rwx,o-rwx + - name: Setup git-shell-commands directory ansible.builtin.file: path: /srv/git/git-shell-commands state: directory owner: git group: git - mode: u+rwx,g-w,o-rwx + mode: u+rwx,g+r,o+rx - name: Copy no-interactive-login command ansible.builtin.copy: @@ -52,7 +63,7 @@ dest: /srv/git/git-shell-commands owner: git group: git - mode: u+rwx,g+rwx,o-rwx + mode: u+rwx,g+r,o+r - name: Enable git-daemon ansible.builtin.service: |