Fernando K pushed to branch main at Root / DMARC Report
Commits:
-
4ce72fa9
by Fernando Monteiro Kiotheka at 2025-08-13T10:37:03-03:00
2 changed files:
Changes:
| ... | ... | @@ -3,32 +3,6 @@ stages: |
| 3 | 3 | |
| 4 | 4 | retrieve-key:
|
| 5 | 5 | stage : setup
|
| 6 | - script:
|
|
| 7 | - - |
|
|
| 8 | - |
|
| 9 | - ssh-keygen -t ed25519 -f key -N '' -q <<<y > /dev/null 2>&1
|
|
| 10 | - |
|
| 11 | - UNSIGNED_SSH_KEY=$(cat key.pub)
|
|
| 12 | - |
|
| 13 | - response=$(curl -X POST -H "X-Vault-Token: $CI_VAULT_TOKEN" -d "{\"public_key\": \"$UNSIGNED_SSH_KEY\"}" $CI_VAULT_ADDR/v1/$CI_VAULT_SIGNER_AUTHORITY_PATH)
|
|
| 14 | - if [ $? -eq 0 ]; then
|
|
| 15 | - SIGNED_KEY=$(echo $response | jq -r .data.signed_key)
|
|
| 16 | - if [ "$SIGNED_KEY" != "null" ]; then
|
|
| 17 | - echo $SIGNED_KEY > key-cert.pub
|
|
| 18 | - chmod 644 key-cert.pub
|
|
| 19 | - else
|
|
| 20 | - echo "Failed to retrieve SSH key: SSH key is empty"
|
|
| 21 | - exit 1
|
|
| 22 | - fi
|
|
| 23 | - else
|
|
| 24 | - echo "Failed to retrieve SSH key: Request to Vault failed"
|
|
| 25 | - exit 1
|
|
| 26 | - fi
|
|
| 27 | -
|
|
| 28 | - ssh -i key -o StrictHostKeyChecking=accept-new ansible@dmarc-report.c3sl.ufpr.br /home/ansible/dmarcts-report-parser/dmarcts-report-parser.pl -i
|
|
| 29 | - |
|
| 30 | - artifacts:
|
|
| 31 | - paths:
|
|
| 32 | - - key
|
|
| 33 | - - key.pub
|
|
| 34 | - - key-cert.pub |
|
| 6 | + script: |-
|
|
| 7 | + sh get-key-from-bao.sh
|
|
| 8 | + ssh -i key -o StrictHostKeyChecking=accept-new root@dmarc-report.c3sl.ufpr.br /home/ansible/dmarcts-report-parser/dmarcts-report-parser.pl -i |
| 1 | +#!/bin/sh
|
|
| 2 | +response=$(curl --no-progress-meter --request POST \
|
|
| 3 | + --header "X-Vault-Token: $VAULT_TOKEN" --data '{"key_type": "ed25519"}' \
|
|
| 4 | + "$VAULT_ADDR/v1/ssh-client-signer/issue/ansible") \
|
|
| 5 | + || { echo "Failed to retrieve SSH key: Request to Vault failed"; exit 1; }
|
|
| 6 | +private_key=$(printf "%s" "$response" | jq --raw-output .data.private_key)
|
|
| 7 | +signed_key=$(printf "%s" "$response" | jq --raw-output .data.signed_key)
|
|
| 8 | +[ "$signed_key" != "null" ] && [ "$private_key" != "null" ] \
|
|
| 9 | + || { echo "Failed to retrieve SSH key: SSH key is empty"; exit 1; }
|
|
| 10 | +printf "%s\n" "$private_key" >key && chmod 600 key
|
|
| 11 | +printf "%s\n" "$signed_key" >key-cert.pub && chmod 644 key-cert.pub |