fix(ansible): compare sshd -T output case-insensitively

The second deploy-ssh-ca run on proxy-1 failed at the assert although all three settings were active: OpenSSH 10.6 prints them as TrustedUserCAKeys, AuthorizedPrincipalsFile and RevokedKeys, the check expected lowercase keywords. The run stopped before the reload, so the running sshd still has the old config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Merge pull request 'fix(ansible): ssh-ca reloads sshd by its real unit name' (#1468 ) from ssh-ca-reload-fix into main
2026-10-27 10:24:41 +01:00 · 2026-10-27 09:09:51 +00:00 · 2026-10-27 10:05:19 +01:00 · 2026-10-27 08:53:33 +00:00 · 2026-10-27 09:50:58 +01:00 · 2026-10-27 08:50:46 +00:00
26 changed files with 291 additions and 28 deletions
@@ -35,25 +35,25 @@ when:
 steps:
  - name: model-selection-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-model-selection.sh

  - name: pr-review-mistral-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-pr-review-mistral.sh

  - name: promtool-rules-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-promtool-rules.sh

  - name: yaml-citations-guard-tests
    depends_on: []
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-yaml-citations.sh

@@ -0,0 +1,34 @@
+when:
+  # Deploy only on main (merge) + manual — never auto-deploy from a branch.
+  - event: push
+    branch: main
+    path:
+      - "ansible/roles/ssh-ca/**"
+      - "ansible/plays/configure-ssh-ca.yml"
+      - "ansible/inventory/pve_hosts.yml"
+      - ".woodpecker/deploy-ssh-ca.yml"
+  - event: deployment
+    evaluate: 'CI_PIPELINE_DEPLOY_TARGET == "deploy-ssh-ca"'
+
+timeout: 30
+
+steps:
+  - name: deploy-ssh-ca
+    image: gitea.renner.uno/gitea_admin/ci-ansible:2026-04-29
+    environment:
+      ANSIBLE_FORCE_COLOR: "true"
+      ANSIBLE_HOST_KEY_CHECKING: "false"
+      ANSIBLE_ROLES_PATH: "../roles:./roles"
+      SSH_PRIVATE_KEY:
+        from_secret: ssh_private_key
+      VAULT_PASS:
+        from_secret: vault_pass
+    commands:
+      - mkdir -p ~/.ssh
+      - echo "$SSH_PRIVATE_KEY" | base64 -d > ~/.ssh/id_ed25519
+      - chmod 600 ~/.ssh/id_ed25519
+      - printf "Host *\n\tStrictHostKeyChecking no\n\tUserKnownHostsFile /dev/null\n" > ~/.ssh/config
+      - cd ansible
+      - echo "$VAULT_PASS" > .vault_pass && chmod 600 .vault_pass
+      - export ANSIBLE_VAULT_PASSWORD_FILE=.vault_pass
+      - ansible-playbook -i inventory/ plays/configure-ssh-ca.yml -v
@@ -26,7 +26,7 @@ steps:
    # fetch-models.sh response mapping. No cluster, no secrets, no network — the
    # ci-claude image just provides sh + jq. Keeps the flag-injection regression
    # test from rotting (it exercises the exact injection shapes).
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    commands:
      - sh scripts/ci/test-model-selection.sh

@@ -70,7 +70,7 @@ steps:
    # this step is skipped — otherwise we'd fork-bomb PRs.
    when:
      - branch: main
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -30,7 +30,7 @@ when:

 steps:
  - name: update-audit-agent
-    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.310
+    image: gitea.renner.uno/gitea_admin/ci-claude:2.1.311
    environment:
      CLAUDE_CODE_OAUTH_TOKEN:
        from_secret: claude_code_oauth_token
@@ -69,3 +69,9 @@ edge_host
 # home, so it must NOT be used as ansible_host.
 [claude_workstation]
 claude-ws ansible_host=10.3.40.78 ansible_user=root
+
+# Hosts that trust the OpenBao SSH user CA (plays/configure-ssh-ca.yml).
+# Rolled out one host at a time: add the next host after the previous one
+# was verified.
+[ssh_ca]
+proxy-1.renner.uno
@@ -0,0 +1,15 @@
+---
+# Trust the OpenBao SSH user CA (ssh-client-signer) on the hosts in [ssh_ca]:
+# owner certificates (principal k.renner) for root/ladmin, Claude's 1h
+# certificates (principal claude-bot) for its own claude-bot account with
+# limited sudo. Existing authorized_keys stay untouched.
+#
+# serial: 1 so a host whose sshd rejects the change stops the run before the
+# next host is touched.
+- name: Configure the SSH user CA
+  hosts: ssh_ca
+  become: true
+  gather_facts: true
+  serial: 1
+  roles:
+    - ssh-ca
@@ -0,0 +1,18 @@
+---
+# SSH user CA (OpenBao ssh-client-signer). Hosts trust certificates signed by
+# it; the public key is fetched from OpenBao on the controller at run time.
+ssh_ca_public_key_url: "https://openbao.renner.uno/v1/ssh-client-signer/public_key"
+
+# Owner certificates (role owner) carry this principal. It is accepted for
+# whichever admin login the distro has; users that do not exist are skipped.
+ssh_ca_owner_principal: k.renner
+ssh_ca_owner_users:
+  - root
+  - ladmin
+
+# Claude's own account. Certificates (role claude, 1h) carry the principal.
+ssh_ca_claude_user: claude-bot
+ssh_ca_claude_principal: claude-bot
+
+# Units claude-bot may restart/reload via sudo on this host, e.g. [netbird].
+ssh_ca_claude_sudo_units: []
@@ -0,0 +1,2 @@
+# Public keys whose certificates sshd must reject (one per line, OpenSSH format).
+# Revoking a key also revokes every certificate issued for it.
@@ -0,0 +1,139 @@
+---
+- name: Fetch the SSH CA public key from OpenBao
+  ansible.builtin.uri:
+    url: "{{ ssh_ca_public_key_url }}"
+    return_content: true
+  delegate_to: localhost
+  become: false
+  run_once: true
+  register: ssh_ca_key
+
+- name: Check the fetched CA key is an SSH public key
+  ansible.builtin.assert:
+    that:
+      - ssh_ca_key.content is match('^ssh-ed25519 AAAA')
+    fail_msg: "Unexpected CA key from {{ ssh_ca_public_key_url }}"
+  run_once: true
+
+- name: Install the trusted user CA key
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_key.content | trim }}\n"
+    dest: /etc/ssh/trusted_user_ca_keys
+    owner: root
+    group: root
+    mode: "0644"
+
+# sshd refuses all public key logins when RevokedKeys is set but unreadable,
+# so the file is always deployed, even when empty.
+- name: Install the revoked keys list
+  ansible.builtin.copy:
+    src: revoked_keys
+    dest: /etc/ssh/revoked_keys
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Create the Claude account
+  ansible.builtin.user:
+    name: "{{ ssh_ca_claude_user }}"
+    shell: /bin/bash
+    create_home: true
+    password: "!"
+
+- name: Look up the owner admin logins
+  ansible.builtin.getent:
+    database: passwd
+    key: "{{ item }}"
+    fail_key: false
+  loop: "{{ ssh_ca_owner_users }}"
+  register: ssh_ca_owner_lookup
+
+- name: Create the principals directory
+  ansible.builtin.file:
+    path: /etc/ssh/auth_principals
+    state: directory
+    owner: root
+    group: root
+    mode: "0755"
+
+- name: Accept the owner principal for the existing admin logins
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_owner_principal }}\n"
+    dest: "/etc/ssh/auth_principals/{{ item.item }}"
+    owner: root
+    group: root
+    mode: "0644"
+  loop: "{{ ssh_ca_owner_lookup.results }}"
+  loop_control:
+    label: "{{ item.item }}"
+  when: (item.ansible_facts.getent_passwd | default({})).get(item.item) is not none
+
+- name: Accept the Claude principal for the Claude account
+  ansible.builtin.copy:
+    content: "{{ ssh_ca_claude_principal }}\n"
+    dest: "/etc/ssh/auth_principals/{{ ssh_ca_claude_user }}"
+    owner: root
+    group: root
+    mode: "0644"
+
+- name: Install the Claude sudo rules
+  ansible.builtin.template:
+    src: sudoers-claude.j2
+    dest: "/etc/sudoers.d/{{ ssh_ca_claude_user }}"
+    owner: root
+    group: root
+    mode: "0440"
+    validate: visudo -cf %s
+
+# A broken drop-in only bites on the next sshd restart, so it is tested here
+# and removed again if the full config does not parse.
+- name: Configure sshd for the user CA
+  block:
+    - name: Install the sshd drop-in
+      ansible.builtin.template:
+        src: ssh-ca.conf.j2
+        dest: /etc/ssh/sshd_config.d/50-ssh-ca.conf
+        owner: root
+        group: root
+        mode: "0644"
+
+    - name: Test the full sshd config
+      ansible.builtin.command: sshd -t
+      changed_when: false
+  rescue:
+    - name: Remove the drop-in that broke sshd -t
+      ansible.builtin.file:
+        path: /etc/ssh/sshd_config.d/50-ssh-ca.conf
+        state: absent
+
+    - name: Fail the host
+      ansible.builtin.fail:
+        msg: "sshd -t failed with the SSH CA drop-in; it was removed again"
+
+- name: Read the effective sshd settings
+  ansible.builtin.command: sshd -T
+  changed_when: false
+  register: ssh_ca_effective
+
+# Keyword case in sshd -T output differs between OpenSSH versions (mixed case
+# on 10.6), so the lines are compared lowercased.
+- name: Check sshd uses the CA, principals and revocation list
+  vars:
+    ssh_ca_effective_lines: "{{ ssh_ca_effective.stdout_lines | map('lower') | list }}"
+  ansible.builtin.assert:
+    that:
+      - "'trustedusercakeys /etc/ssh/trusted_user_ca_keys' in ssh_ca_effective_lines"
+      - "'authorizedprincipalsfile /etc/ssh/auth_principals/%u' in ssh_ca_effective_lines"
+      - "'revokedkeys /etc/ssh/revoked_keys' in ssh_ca_effective_lines"
+    fail_msg: "sshd -T does not show the SSH CA settings; another config line takes precedence"
+
+# The unit is sshd.service on Arch and RedHat, ssh.service on Debian. sshd -T
+# only parses the files, so the running daemon is reloaded on every run; a
+# reload keeps open sessions.
+- name: Read the service list
+  ansible.builtin.service_facts:
+
+- name: Reload sshd so the running daemon uses the CA config
+  ansible.builtin.systemd:
+    name: "{{ 'sshd.service' if 'sshd.service' in ansible_facts.services else 'ssh.service' }}"
+    state: reloaded
@@ -0,0 +1,4 @@
+# {{ ansible_managed }}
+TrustedUserCAKeys /etc/ssh/trusted_user_ca_keys
+AuthorizedPrincipalsFile /etc/ssh/auth_principals/%u
+RevokedKeys /etc/ssh/revoked_keys
@@ -0,0 +1,6 @@
+# {{ ansible_managed }}
+# NOEXEC: journalctl/systemctl open a pager, which must not spawn a shell.
+{{ ssh_ca_claude_user }} ALL=(root) NOPASSWD:NOEXEC: /usr/bin/journalctl, /usr/bin/journalctl *, /usr/bin/systemctl status, /usr/bin/systemctl status *, /usr/bin/systemctl list-units, /usr/bin/systemctl list-units *, /usr/bin/ss -tulpn, /usr/sbin/sshd -T
+{% for unit in ssh_ca_claude_sudo_units %}
+{{ ssh_ca_claude_user }} ALL=(root) NOPASSWD:NOEXEC: /usr/bin/systemctl restart {{ unit }}, /usr/bin/systemctl reload {{ unit }}
+{% endfor %}
@@ -105,7 +105,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-25-1458 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
+          image: gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-27-0801 # {"$imagepolicy": "flux-system:authentik-gate-sync"}
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-25-1504 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
+          image: gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-27-0807 # {"$imagepolicy": "flux-system:cloudflare-lb-sync"}
          env:
            - name: CLOUDFLARE_API_TOKEN
              valueFrom:
@@ -32,7 +32,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: sync
-              image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+              image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
              command:
                - /opt/hermes/.venv/bin/python
                - /opt/hermes-skills/gitea-issues/scripts/sync_webhook.py
@@ -51,7 +51,7 @@ spec:
        # connects from the pod network. No env equivalent exists, so it is
        # set in config.yaml on every start (idempotent).
        - name: config
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -75,7 +75,7 @@ spec:
              mountPath: /opt/data
        # WebSocket keepalive ping interval in seconds (default 20).
        - name: config-ws-ping
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -99,7 +99,7 @@ spec:
              mountPath: /opt/data
        # Skills from git (ConfigMap hermes-skills) beside the PVC's skills/.
        - name: skills-config
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -130,7 +130,7 @@ spec:
        # - alert-monitor: hourly; the script wakes the agent only for
        #   untriaged alerts.
        - name: cron-jobs
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal: a broken jobs.json or a changed cron CLI after an image
          # bump logs a warning instead of keeping Hermes from starting.
          command:
@@ -187,7 +187,7 @@ spec:
              readOnly: true
        # Home Assistant MCP server; token resolved from HA_TOKEN at connect, writes need approval.
        - name: config-mcp-homeassistant
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - /opt/hermes/.venv/bin/hermes
            - config
@@ -214,7 +214,7 @@ spec:
        # skills, the Home Assistant MCP and the tea login are re-applied on
        # every start. default gets the kanban toolset to hand cards to them.
        - name: experts
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal like cron-jobs: a broken expert logs a warning.
          command:
            - sh
@@ -305,7 +305,7 @@ spec:
        # Gitea issues -> kanban (skills/gitea-issues): route script, webhook route on default,
        # completion shell hook plus its allowlist entry on every profile.
        - name: gitea-issues
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          # Non-fatal like cron-jobs: a failure logs a warning.
          command:
            - sh
@@ -368,7 +368,7 @@ spec:
              readOnly: true
        # Multiplexed default reads platform credentials only from .env (rationale: commit message).
        - name: default-env
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          # Fatal on a writer failure: without these Matrix and the API server stay down.
          command:
            - /opt/hermes/.venv/bin/python
@@ -428,7 +428,7 @@ spec:
        # tea login hermes-bot, written from the mounted token into an
        # emptyDir at the agent's ~/.config/tea.
        - name: tea-login
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          command:
            - sh
            - -ec
@@ -457,7 +457,7 @@ spec:
              readOnly: true
      containers:
        - name: hermes
-          image: gitea.renner.uno/konairius/hermes:build.1792940452 # {"$imagepolicy": "flux-system:hermes"}
+          image: gitea.renner.uno/konairius/hermes:build.1793088058 # {"$imagepolicy": "flux-system:hermes"}
          args: ["gateway", "run"]
          env:
            - name: HERMES_DASHBOARD
@@ -30,7 +30,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: controller
-          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-25-1459 # {"$imagepolicy": "flux-system:kuma-sync"}
+          image: gitea.renner.uno/gitea_admin/kuma-sync:2026-10-27-0801 # {"$imagepolicy": "flux-system:kuma-sync"}
          env:
            - name: KUMA_URL
              value: https://kuma.renner.uno
@@ -22,7 +22,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: gotenberg
-          image: gotenberg/gotenberg:8.38.1 # {"$imagepolicy": "flux-system:gotenberg"}
+          image: gotenberg/gotenberg:8.39.0 # {"$imagepolicy": "flux-system:gotenberg"}
          args:
            - "gotenberg"
            - "--chromium-disable-javascript=true"
@@ -32,7 +32,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: review-bot
-          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-26-0647 # {"$imagepolicy": "flux-system:review-bot"}
+          image: gitea.renner.uno/gitea_admin/review-bot:2026-10-27-0757 # {"$imagepolicy": "flux-system:review-bot"}
          env:
            - name: REPOS
              value: konairius/homelab,konairius/homeassistant,konairius/authentik-samba-bridge,konairius/shelly-manager
@@ -72,7 +72,7 @@ spec:
              command:
                - sh
                - -c
-                - 'curl -fsS --max-time 1700 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/sync'
+                - 'curl -fsS --retry 12 --retry-delay 10 --retry-connrefused --retry-max-time 120 --max-time 1700 -X POST -H "X-Api-Key: $API_KEY" http://wiki.ai.svc.cluster.local:8080/api/v1/sync'
              env:
                - name: API_KEY
                  valueFrom:
@@ -0,0 +1,10 @@
+# OpenBao policy: ssh-sign-claude
+# Sign claude-bot's SSH public key on ssh-client-signer role claude (1h certs). Attached to userpass user claude-bot. NOT applied by Flux.
+#
+#   bao write ssh-client-signer/roles/claude @kubernetes/infrastructure/openbao/ssh-ca/role-claude.json
+#   bao policy write ssh-sign-claude kubernetes/infrastructure/openbao/policies/ssh-sign-claude.hcl
+#   bao write auth/userpass/users/claude-bot token_policies=claude-bot-write,ssh-sign-claude
+
+path "ssh-client-signer/sign/claude" {
+  capabilities = ["update"]
+}
@@ -1,6 +1,9 @@
 # OpenBao policy: ssh-sign-owner
 # Sign the owner's SSH public keys on ssh-client-signer role owner. Bound to auth/oidc role owner. NOT applied by Flux.
 #
+#   bao secrets enable -path=ssh-client-signer -max-lease-ttl=4380h ssh   # 768h default would cap the 6-month certs
+#   bao write ssh-client-signer/config/ca generate_signing_key=true key_type=ed25519
+#   bao write ssh-client-signer/roles/owner @kubernetes/infrastructure/openbao/ssh-ca/role-owner.json
 #   bao policy write ssh-sign-owner kubernetes/infrastructure/openbao/policies/ssh-sign-owner.hcl
 #   bao auth enable oidc
 #   bao write auth/oidc/config oidc_discovery_url=https://auth.renner.uno/application/o/openbao/ \
@@ -71,7 +71,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-27 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -133,7 +133,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-27 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -195,7 +195,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: rotate
-              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-26 # {"$imagepolicy": "flux-system:secret-rotator"}
+              image: gitea.renner.uno/gitea_admin/secret-rotator:2026-10-27 # {"$imagepolicy": "flux-system:secret-rotator"}
              args: ["ha-token"]
              securityContext:
                allowPrivilegeEscalation: false
@@ -0,0 +1,12 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "claude-bot",
+  "default_user": "claude-bot",
+  "allowed_extensions": "permit-pty",
+  "default_extensions": {
+    "permit-pty": ""
+  },
+  "ttl": "1h",
+  "max_ttl": "1h"
+}
@@ -0,0 +1,14 @@
+{
+  "key_type": "ca",
+  "allow_user_certificates": true,
+  "allowed_users": "k.renner",
+  "default_user": "k.renner",
+  "allowed_extensions": "permit-pty,permit-port-forwarding,permit-agent-forwarding,permit-user-rc",
+  "default_extensions": {
+    "permit-pty": "",
+    "permit-port-forwarding": "",
+    "permit-user-rc": ""
+  },
+  "ttl": "4380h",
+  "max_ttl": "4380h"
+}
@@ -32,7 +32,7 @@ spec:
              type: RuntimeDefault
          containers:
            - name: backup-verify
-              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-25 # {"$imagepolicy": "flux-system:backup-verify"}
+              image: gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-27 # {"$imagepolicy": "flux-system:backup-verify"}
              command: ["bash", "/script/backup-verify.sh"]
              env:
                - name: HOME
Author	SHA1	Message	Date
claude-botandClaude Opus 5.5	e6e0e44b6a	fix(ansible): compare sshd -T output case-insensitively ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The second deploy-ssh-ca run on proxy-1 failed at the assert although all three settings were active: OpenSSH 10.6 prints them as TrustedUserCAKeys, AuthorizedPrincipalsFile and RevokedKeys, the check expected lowercase keywords. The run stopped before the reload, so the running sshd still has the old config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:24:41 +01:00
k.renner	39b7fc7fc3	Merge pull request 'fix(ansible): ssh-ca reloads sshd by its real unit name' (#1468 ) from ssh-ca-reload-fix into main ci/woodpecker/push/deploy-ssh-ca Pipeline failed Details Reviewed-on: #1468 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 09:09:51 +00:00
claude-botandClaude Opus 5.5	33dd968a25	fix(ansible): reload sshd by its real unit name on every run ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details The first deploy to proxy-1 failed at the reload: 'Could not find the requested service ssh'. proxy-1 is not Debian (banner OpenSSH_10.6 without distro suffix, root shell /usr/bin/bash), so the unit is sshd.service; the handler only special-cased RedHat. The unit is now picked from service_facts. The reload runs on every run instead of via a handler: sshd -T only parses the files, so after a failed reload a re-run with nothing changed would otherwise leave the running daemon on the old config. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 10:05:19 +01:00
k.renner	d8813a68b7	Merge pull request 'feat(ansible): hosts trust the OpenBao SSH user CA (SSH CA phase 2)' (#1467 ) from ssh-ca-phase2 into main ci/woodpecker/push/deploy-ssh-ca Pipeline failed Details Reviewed-on: #1467	2026-10-27 08:53:33 +00:00
claude-botandClaude Opus 5.5	9dcaf42f96	fix(ansible): start the SSH CA rollout on proxy-1 ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline failed Details claude-ws is decommissioned. proxy-1 resolves by name, answers on 22, and has proxy-2 as its twin, so the public edge survives a bad run. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 09:50:58 +01:00
security-bot	d033503fc3	chore(image-automation): bump gotenberg/gotenberg:8.39.0 Updates managed by image-automation-controller.	2026-10-27 08:50:46 +00:00
claude-botandClaude Opus 5.5	66c56288a7	feat(ansible): hosts trust the OpenBao SSH user CA (phase 2) ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details New role ssh-ca with play configure-ssh-ca.yml (serial: 1) and pipeline deploy-ssh-ca. Hosts in the new [ssh_ca] group get: - TrustedUserCAKeys from OpenBao's public_key endpoint, fetched on the controller at run time (no copy in git). - AuthorizedPrincipalsFile: k.renner for root/ladmin (whichever exists), claude-bot for Claude's own claude-bot account. - RevokedKeys, always deployed: sshd refuses all key logins when the file is set but missing. - claude-bot sudo: read-only journalctl/systemctl status/ss/sshd -T, restart/reload only for ssh_ca_claude_sudo_units; NOEXEC against pager shell escapes; visudo-validated. The drop-in is tested with sshd -t and removed again on failure; sshd -T must show all three settings afterwards. authorized_keys is untouched, so this only adds a login path. [ssh_ca] starts with claude-ws only. ssh-sign-owner.hcl now also records the mount, CA and owner role commands (review on #1466). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 09:47:48 +01:00
k.renner	2b309dec92	Merge pull request 'feat(openbao): SSH client CA roles (SSH CA phase 1)' (#1466 ) from ssh-ca-phase1 into main Reviewed-on: #1466	2026-10-27 08:42:24 +00:00
k.renner	396f839567	Merge pull request 'chore(ci): bump ci-claude image to 2.1.311' (#1464 ) from ci-image/claude-2.1.311 into main Reviewed-on: #1464 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 08:42:06 +00:00
claude-botandClaude Opus 5.5	2e412e6448	feat(openbao): SSH client CA roles for owner and claude-bot ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Phase 1 of the SSH CA. The ssh-client-signer mount and its ed25519 CA were set up by hand (root token); this records the roles and the claude-bot signing policy. - role owner: principal k.renner, 6-month certs. The mount was enabled with -max-lease-ttl=4380h; the 768h system default would cap it. - role claude: principal claude-bot, 1h certs, pty only. - policy ssh-sign-claude for the claude-bot userpass user, next to its existing claude-bot-write. Verified: a YubiKey sk-ssh-ed25519 key signed on role owner yields a sk-ssh-ed25519-cert-v01 cert, principal k.renner, valid to 2027-04-27. CA fingerprint SHA256:xEhuqxqFVZ/ig6KpAtHOhLbwsIhyWpzXhvDcjIfM/Js, served unauthenticated at /v1/ssh-client-signer/public_key. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-10-27 09:39:19 +01:00
security-bot	7f61ad0ce9	chore(image-automation): bump gitea.renner.uno/gitea_admin/review-bot:2026-10-27-0757 gitea.renner.uno/gitea_admin/ci-backup-verify:2026-10-27 Updates managed by image-automation-controller.	2026-10-27 08:23:50 +00:00
security-bot	6503161146	chore(image-automation): bump gitea.renner.uno/gitea_admin/kuma-sync:2026-10-27-0801 Updates managed by image-automation-controller.	2026-10-27 08:23:47 +00:00
security-bot	01133ca106	chore(image-automation): bump gitea.renner.uno/gitea_admin/secret-rotator:2026-10-27 Updates managed by image-automation-controller.	2026-10-27 08:23:46 +00:00
security-bot	ce5be4d067	chore(image-automation): bump gitea.renner.uno/gitea_admin/cloudflare-lb-sync:2026-10-27-0807 Updates managed by image-automation-controller.	2026-10-27 08:17:10 +00:00
security-bot	150e8229fd	chore(image-automation): bump gitea.renner.uno/konairius/hermes:build.1793088058 Updates managed by image-automation-controller.	2026-10-27 08:07:03 +00:00
security-bot	0247b3dfd5	chore(image-automation): bump gitea.renner.uno/gitea_admin/authentik-gate-sync:2026-10-27-0801 Updates managed by image-automation-controller.	2026-10-27 08:06:48 +00:00
claude-bot	9b7a64e48c	chore(ci): bump ci-claude image to 2.1.311 ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details	2026-10-27 07:53:48 +00:00
k.renner	aee26df4b8	Merge pull request 'fix(wiki): wiki-sync retries while the wiki pod restarts' (#1462 ) from alert-fix/issue-1461 into main Reviewed-on: #1462 Reviewed-by: Review Bot <review-bot@renner.uno>	2026-10-27 07:53:21 +00:00
k.renner	0bf2cd309e	Merge pull request 'feat(openbao): OIDC login via Authentik (SSH CA phase 0)' (#1463 ) from worktree-openbao-oidc-authentik into main ci/woodpecker/push/ci-claude-refresh Pipeline was successful Details ci/woodpecker/push/deploy-claude-workstation Pipeline failed Details ci/woodpecker/push/deploy-edge-mqtt-bridge Pipeline was successful Details ci/woodpecker/push/deploy-infrastructure Pipeline was successful Details ci/woodpecker/push/deploy-netbird-client Pipeline failed Details ci/woodpecker/push/deploy-netbird-proxy Pipeline was successful Details ci/woodpecker/push/deploy-netbird-server Pipeline was successful Details ci/woodpecker/push/deploy-uptime-kuma Pipeline was successful Details ci/woodpecker/push/hermes-image Pipeline was successful Details ci/woodpecker/push/build-ci-images Pipeline was successful Details Reviewed-on: #1463	2026-10-27 07:52:50 +00:00
hermes-bot	be4e605d65	fix(wiki): wiki-sync retry window covers the full 120 s ci/woodpecker/pr/ci-scripts-test Pipeline failed Details ci/woodpecker/pr/ci-manifests-test Pipeline was successful Details Six retries at a fixed 10 s delay stopped after about 60 s, so --retry-max-time 120 never bound. Twelve retries let the 120 s cap be the limit, covering a Recreate rollout slowed by an image pull. Retrying on 5xx is safe: POST /api/v1/sync is serialized by SyncCoordinator and re-syncs the same state, the same as a webhook landing mid-sync. --retry-max-time 120 keeps a long sync that fails late from being repeated.	2026-10-27 07:27:46 +00:00
hermes-bot	10cb1c2152	fix(wiki): wiki-sync retries while the wiki pod restarts ci/woodpecker/pr/ci-scripts-test Pipeline was successful Details ci/woodpecker/pr/ci-manifests-test Pipeline was canceled Details The wiki Deployment uses Recreate, so during an image rollout the Service has no ready endpoint for ~10 s. wiki-sync-29884710 started 06:30:00Z, 4 s before the new pod was Ready, failed with curl (7) and fired KubeJobFailed. Retry up to 6 times, 10 s apart, on connection refused too, bounded to 120 s from the first attempt so a long sync that fails is not repeated. Refs #1461	2026-10-27 07:26:13 +00:00