ElebobaandClaude Opus 5.5
c443190bf4
CI / ruff · mypy · pytest (pull_request) Successful in 4m3s
- infra/runner/tgit-runner: deploy/restart/remove/list по SSH forced command; аргументы не исполняются и не глобятся; архив — только файлы и папки, без «..», ≤ 20 МБ, есть main.py; health_url — только localhost - песочница: uid 10001, read-only, tmpfs noexec, cap-drop ALL, no-new-privileges, 128 МБ без swap, 0.25 CPU, 64 PID, --network none (сеть — только по egress-allow админа), лимит 10 сервисов, 2 образа - новая версия стартует рядом (-next) и заменяет старую, только став healthy; иначе удаляется, старая работает, exit 3 - бот: после push git archive изменённых services/<name>/ → runner; автору — «🚀 работает» или «⛔ не развёрнут» с логом, команде — алерт ⛔; удалённая папка → remove; «♻️ Перезапустить» в «Статусе» для админа (S-5) - examples/escape_attempts: все попытки выбраться — BLOCKED на живом Docker - install.sh, authorized_keys.example; CD бота обновляет runner на хосте Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
29 lines
1.2 KiB
Bash
Executable File
29 lines
1.2 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# One-time setup of tgit-runner on the host (as root). Safe to re-run.
|
|
# sudo infra/runner/install.sh /path/to/tgit-runner-key.pub [deploy-user]
|
|
# The key is the bot's runner key (RUNNER_SSH_KEY_B64 holds its private half); it is pinned to the runner only.
|
|
set -euo pipefail
|
|
PUB=${1:?usage: install.sh <runner-key.pub> [user]}
|
|
USER_NAME=${2:-tgit-deploy}
|
|
DIR=/srv/tgit/runner
|
|
HERE=$(cd "$(dirname "$0")" && pwd)
|
|
|
|
id "$USER_NAME" >/dev/null
|
|
install -d -o "$USER_NAME" -g "$USER_NAME" -m 700 "$DIR"
|
|
install -o "$USER_NAME" -g "$USER_NAME" -m 755 "$HERE/tgit-runner" "$DIR/tgit-runner"
|
|
touch "$DIR/egress-allow" && chown "$USER_NAME:" "$DIR/egress-allow" && chmod 600 "$DIR/egress-allow"
|
|
|
|
HOME_DIR=$(getent passwd "$USER_NAME" | cut -d: -f6)
|
|
install -d -o "$USER_NAME" -g "$USER_NAME" -m 700 "$HOME_DIR/.ssh"
|
|
AK=$HOME_DIR/.ssh/authorized_keys
|
|
touch "$AK" && chown "$USER_NAME:" "$AK" && chmod 600 "$AK"
|
|
KEY=$(awk '{print $1" "$2}' "$PUB")
|
|
LINE="command=\"$DIR/tgit-runner\",restrict $KEY tgit-runner"
|
|
if grep -qF "$KEY" "$AK"; then
|
|
echo "key already in $AK — leaving it"
|
|
else
|
|
echo "$LINE" >>"$AK"
|
|
echo "added the runner key to $AK (forced command)"
|
|
fi
|
|
echo "runner installed in $DIR; allow internet for a service: echo <service> >> $DIR/egress-allow"
|