integration with gitolite

Does anyone have any experience with integrating propellor and gitolite? I'd be happy with just ssh pubkey management. There seem to be two main options. The typical way of managing a gitolite site is by pushing a special git repository "gitolite-admin". There are also a script called ukm. I'm not sure what will be the least hassle. Currently I have to manually commit and push various keys (including the keys needed for access to the propellor repos). Part of the problem could be solved by making the propellor repos available anonymously, but I still have my own ssh key(s) to manage.

RSS

"For people who use puppet and similar systems"

Probably the sane way is to not use the gitolite-admin repo. Aside from being unfamiliar, that means I have to deal with a bunch small config files (say 50 - 100) in propellor. So far I'm not loving the idea of converting them all to Haskell, even with a script. But maybe I'll come around to it.

Comment by david — Thu Aug 23 01:46:30 2018

Remove comment

first attempt

Here's my first attempt, so you can snicker at my clumsy Haskell.

gitoliteKeys :: User -> Property UnixLike
gitoliteKeys user@(User username) = property' ("set up gitolite keys for " ++ username) $ \w -> do
      home <- liftIO (User.homedir user)
      ensureProperty w $ go home
  where
    go :: FilePath -> Property UnixLike
    go home = File.hasContent (home  ".gitolite/keydir/zzz/propellor"  "bremner@propellor.pub")
                        [ Tethera.Keys.bremner_ssh ]
              `before`
              (Cmd.userScriptProperty user [ "gitolite compile", "gitolite trigger POST_COMPILE" ]
                           `changesFile` (home  "gitolite/.ssh/authorized_keys"))

I think the next step is something like

Directory.hasContent :: FilePath -> [ (FilePath, [Line]) ] -> Property UnixLike

Comment by david — Thu Aug 23 13:36:52 2018

Remove comment

comment 3

It's not a proper module, but my gitolite setup is here: https://git.spwhitton.name/propellor/tree/src/Propellor/Property/SiteSpecific/SPW/Sites.hs#n200

Comment by spwhitton — Thu Aug 23 19:59:13 2018

Remove comment

version 2

I didn't see how you were handling keys, Sean. Did I miss something obvious or are you handling them outside propellor?

Anyway, here's my second version

gitoliteKeys :: User -> [(FilePath, String)] -> Property UnixLike
gitoliteKeys user@(User username) keys = property' ("set up gitolite keys for " ++ username) $ \w -> do
      home <- liftIO (User.homedir user)
      ensureProperty w $ go home
  where
    go :: FilePath -> Property UnixLike
    go home = installKeys keys
                `onChange` recompile
                `requires` File.dirExists keydir
        where
          keydir = home </> ".gitolite/keydir/zzz/propellor"
          recompile = Cmd.userScriptProperty user [ "gitolite trigger POST_COMPILE" ]
                      `changesFile` (home </> "gitolite/.ssh/authorized_keys")
          installKeys :: [(FilePath, String)] -> Property UnixLike
          installKeys [] = doNothing
          installKeys ((path, content):rest) = File.hasContent (keydir </> path ++ ".pub") [content]
                                               `before` installKeys rest

I spent a while talking to the gitolite author, and managed to write something more optimal than "gitolite trigger POST_COMPILE", but then I realized that had my username hardcoded into it. So it takes about 1s longer to run, but is more robust this way.

Comment by david — Sat Aug 25 17:25:03 2018

Remove comment

comment 5

It's these lines:

-- make my SSH key available to gitolite
& File.hasContent "/srv/git/.gitolite/keydir/spwhitton.pub"
    [SPW.mySSHKey]
`onChange` (userScriptProperty (User "git")
    ["gitolite compile", "gitolite trigger POST_COMPILE"]
    `assume` MadeChange)

Comment by spwhitton — Sun Aug 26 17:14:20 2018

Remove comment

OIC

Oh, I see now we are doing essentially the same thing. For those of you following along at home, mine is using that cryptic path because for the key because I am using both gitolite's native key handling and propellor to install keys.

Comment by david — Mon Aug 27 14:14:09 2018

Remove comment

Add a comment