feat(ansible): proxy-1 accepts only break-glass and CI keys

First host in [ssh_keys_managed]. root on proxy-1 currently has id_ecdsa (krenner@krenner-XPS-13-9310), woodpecker-ci@homelab (SHA256:DQWPS...) and ansible-runner@ci-new (dead since #184). After this run: breakglass-neo-6532348 and the same CI key with its from= pod-network restriction; people log in with CA certificates. proxy-2 is the twin, so the public edge survives a mistake here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'feat(ansible): one admin key list; report authorized_keys (SSH CA phase 4, step 1)' (#1476 ) from ssh-keys-managed into main
2026-10-27 12:49:46 +01:00 · 2026-10-27 11:38:59 +00:00
1 changed files with 1 additions and 0 deletions
@@ -83,3 +83,4 @@ edge-1.iot.renner.uno
 # + CI); everything else needs a CA certificate. Members must be in [ssh_ca].
 # Added one host at a time after the [ssh_ca] report was reviewed.
 [ssh_keys_managed]
+proxy-1.renner.uno
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	04b704fdbd	feat(ansible): proxy-1 accepts only break-glass and CI keys ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details First host in [ssh_keys_managed]. root on proxy-1 currently has id_ecdsa (krenner@krenner-XPS-13-9310), woodpecker-ci@homelab (SHA256:DQWPS...) and ansible-runner@ci-new (dead since #184). After this run: breakglass-neo-6532348 and the same CI key with its from= pod-network restriction; people log in with CA certificates. proxy-2 is the twin, so the public edge survives a mistake here. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 12:49:46 +01:00
k.renner	63df267a2f	Merge pull request 'feat(ansible): one admin key list; report authorized_keys (SSH CA phase 4, step 1)' (#1476 ) from ssh-keys-managed into main ci/woodpecker/push/deploy-infrastructure Pipeline was successful Details ci/woodpecker/push/deploy-ssh-ca Pipeline was successful Details ci/woodpecker/cron/e2e Pipeline failed Details ci/woodpecker/cron/security-scan Pipeline was successful Details Reviewed-on: #1476	2026-10-27 11:38:59 +00:00