103 lines
3.0 KiB
YAML
103 lines
3.0 KiB
YAML
name: 'Configure Homelab SSH'
|
|
description: 'Fetches SSH keys from Infisical and configures SSH config with a jump host'
|
|
inputs:
|
|
infisical_cicd_token:
|
|
description: 'Infisical Service Token for CI/CD secrets'
|
|
required: true
|
|
infisical_api_url:
|
|
description: 'Infisical API URL (for self-hosted instances)'
|
|
required: false
|
|
default: 'https://secrets.itlab-ffeks.dnu.edu.ua'
|
|
infisical_env:
|
|
description: 'Infisical Environment (defaults to Gitea branch/ref name)'
|
|
required: false
|
|
default: ''
|
|
jump_host:
|
|
description: 'Jump host IP or hostname'
|
|
required: false
|
|
default: '212.3.125.242'
|
|
jump_port:
|
|
description: 'Jump host SSH port'
|
|
required: false
|
|
default: '2222'
|
|
jump_user:
|
|
description: 'Jump host SSH username'
|
|
required: false
|
|
default: 'jump'
|
|
vm_ip:
|
|
description: 'Target VM IP'
|
|
required: true
|
|
vm_port:
|
|
description: 'Target VM SSH port'
|
|
required: false
|
|
default: '22'
|
|
vm_user:
|
|
description: 'Target VM SSH username'
|
|
required: false
|
|
default: 'debian'
|
|
ssh_host_alias:
|
|
description: 'Alias for target VM in SSH config'
|
|
required: false
|
|
default: 'vm'
|
|
|
|
runs:
|
|
using: 'composite'
|
|
steps:
|
|
- name: Install Infisical CLI
|
|
shell: bash
|
|
run: |
|
|
if ! command -v infisical &> /dev/null; then
|
|
curl -1sLf 'https://artifacts-cli.infisical.com/setup.deb.sh' | sudo -E bash
|
|
sudo apt-get update && sudo apt-get install -y infisical
|
|
else
|
|
echo "Infisical CLI already installed"
|
|
fi
|
|
|
|
- name: Configure SSH
|
|
shell: bash
|
|
run: |
|
|
mkdir -p ~/.ssh
|
|
chmod 700 ~/.ssh
|
|
|
|
export INFISICAL_TOKEN="${{ inputs.infisical_cicd_token }}"
|
|
export INFISICAL_API_URL="${{ inputs.infisical_api_url }}"
|
|
export INFISICAL_DOMAIN="$INFISICAL_API_URL"
|
|
export INFISICAL_DISABLE_UPDATE_CHECK=true
|
|
|
|
INFISICAL_ENV="${{ inputs.infisical_env }}"
|
|
if [ -z "$INFISICAL_ENV" ]; then
|
|
INFISICAL_ENV="${{ gitea.ref_name }}"
|
|
fi
|
|
|
|
echo "Fetching SSH keys from Infisical..."
|
|
JUMP_KEY=$(infisical secrets get JUMP_SSH_KEY --env="$INFISICAL_ENV" --plain)
|
|
VM_KEY=$(infisical secrets get VM_SSH_KEY --env="$INFISICAL_ENV" --plain)
|
|
|
|
if [ -z "$JUMP_KEY" ] || [ -z "$VM_KEY" ]; then
|
|
echo "Error: SSH keys retrieved from Infisical are empty!" >&2
|
|
exit 1
|
|
fi
|
|
|
|
echo "$JUMP_KEY" > ~/.ssh/jump_key
|
|
chmod 600 ~/.ssh/jump_key
|
|
|
|
echo "$VM_KEY" > ~/.ssh/vm_key
|
|
chmod 600 ~/.ssh/vm_key
|
|
|
|
cat > ~/.ssh/config <<EOF
|
|
Host jump
|
|
HostName ${{ inputs.jump_host }}
|
|
User ${{ inputs.jump_user }}
|
|
Port ${{ inputs.jump_port }}
|
|
IdentityFile ~/.ssh/jump_key
|
|
StrictHostKeyChecking no
|
|
|
|
Host ${{ inputs.ssh_host_alias }}
|
|
HostName ${{ inputs.vm_ip }}
|
|
User ${{ inputs.vm_user }}
|
|
Port ${{ inputs.vm_port }}
|
|
IdentityFile ~/.ssh/vm_key
|
|
ProxyJump jump
|
|
StrictHostKeyChecking no
|
|
EOF
|