tdehaeze/literate-dotfiles
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Just generate one ssh key per machine

Browse Source
This commit is contained in:
Thomas Dehaeze
2026-04-15 15:17:06 +02:00
parent b8eb9cbc0e
commit 24adaf03c3
2 changed files with 62 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
install.org
+30 -22
View File
@@ -345,31 +345,38 @@ paru -S --needed \
** SSH Keys for Tunnels ** SSH Keys for Tunnels
Use a single SSH key for all hosts (matches =~/.ssh/config=).
#+begin_src bash #+begin_src bash
setup_ssh_key() { KEY_FILE="$HOME/.ssh/id_ed25519"
local key_name="$1" HOMELAB_OK=1
local remote_host="$2" ESRF_OK=1
local remote_port="${3:-22}"
local key_file="$HOME/.ssh/id_ed25519_${key_name}"
# Generate main SSH key if it doesn't exist
if [ ! -f "${KEY_FILE}" ]; then
echo "" echo ""
echo "==> Setting up SSH key for ${key_name}" echo "==> Generating main SSH key"
read -p "Generate new SSH key at ${KEY_FILE}? [y/N] " -n 1 -r
# Generate key if it doesn't exist
if [ ! -f "${key_file}" ]; then
read -p "Generate new SSH key for ${key_name}? [y/N] " -n 1 -r
echo echo
if [[ $REPLY =~ ^[Yy]$ ]]; then if [[ $REPLY =~ ^[Yy]$ ]]; then
ssh-keygen -t ed25519 -C "${key_name}-tunnel" -f "${key_file}" -N "" ssh-keygen -t ed25519 -C "thomas@$(hostname)" -f "${KEY_FILE}" -N ""
else else
echo "Skipping ${key_name} key generation" echo "Skipping SSH key generation"
return 1
fi
fi fi
fi
# Deploy key to a remote host if needed
deploy_ssh_key() {
local host_name="$1"
local remote_host="$2"
local remote_port="${3:-22}"
echo ""
echo "==> Checking SSH key for ${host_name}"
# Check if we can connect without password # Check if we can connect without password
if ssh -o BatchMode=yes -o ConnectTimeout=5 -p "${remote_port}" -i "${key_file}" "${remote_host}" exit 2>/dev/null; then if ssh -o BatchMode=yes -o ConnectTimeout=5 -p "${remote_port}" "${remote_host}" exit 2>/dev/null; then
echo "SSH key for ${key_name} is already deployed ✓" echo "SSH key for ${host_name} is already deployed ✓"
return 0 return 0
fi fi
@@ -377,19 +384,20 @@ setup_ssh_key() {
read -p "Deploy SSH key to ${remote_host}? [y/N] " -n 1 -r read -p "Deploy SSH key to ${remote_host}? [y/N] " -n 1 -r
echo echo
if [[ $REPLY =~ ^[Yy]$ ]]; then if [[ $REPLY =~ ^[Yy]$ ]]; then
ssh-copy-id -i "${key_file}.pub" -p "${remote_port}" "${remote_host}" ssh-copy-id -i "${KEY_FILE}.pub" -p "${remote_port}" "${remote_host}"
return 0
else else
echo "Skipping ${key_name} key deployment" echo "Skipping ${host_name} key deployment"
return 1 return 1
fi fi
} }
# Setup homelab key # Setup homelab
setup_ssh_key "homelab" "homelab" 22 deploy_ssh_key "homelab" "homelab" 22
HOMELAB_OK=$? HOMELAB_OK=$?
# Setup ESRF key # Setup ESRF
setup_ssh_key "esrf" "dehaeze@firewall.esrf.fr" 8022 deploy_ssh_key "esrf" "dehaeze@firewall.esrf.fr" 8022
ESRF_OK=$? ESRF_OK=$?
#+end_src #+end_src
scripts/install-main.sh
+28 -22
View File
@@ -113,30 +113,35 @@ paru -S --needed \
highlight-pointer-git \ highlight-pointer-git \
mpd mpd
setup_ssh_key() { KEY_FILE="$HOME/.ssh/id_ed25519"
local key_name="$1" HOMELAB_OK=1
local remote_host="$2" ESRF_OK=1
local remote_port="${3:-22}"
local key_file="$HOME/.ssh/id_ed25519_${key_name}"
# Generate main SSH key if it doesn't exist
if [ ! -f "${KEY_FILE}" ]; then
echo "" echo ""
echo "==> Setting up SSH key for ${key_name}" echo "==> Generating main SSH key"
read -p "Generate new SSH key at ${KEY_FILE}? [y/N] " -n 1 -r
# Generate key if it doesn't exist
if [ ! -f "${key_file}" ]; then
read -p "Generate new SSH key for ${key_name}? [y/N] " -n 1 -r
echo echo
if [[ $REPLY =~ ^[Yy]$ ]]; then if [[ $REPLY =~ ^[Yy]$ ]]; then
ssh-keygen -t ed25519 -C "${key_name}-tunnel" -f "${key_file}" -N "" ssh-keygen -t ed25519 -C "thomas@$(hostname)" -f "${KEY_FILE}" -N ""
else else
echo "Skipping ${key_name} key generation" echo "Skipping SSH key generation"
return 1
fi
fi fi
fi
# Deploy key to a remote host if needed
deploy_ssh_key() {
local host_name="$1"
local remote_host="$2"
local remote_port="${3:-22}"
echo ""
echo "==> Checking SSH key for ${host_name}"
# Check if we can connect without password # Check if we can connect without password
if ssh -o BatchMode=yes -o ConnectTimeout=5 -p "${remote_port}" -i "${key_file}" "${remote_host}" exit 2>/dev/null; then if ssh -o BatchMode=yes -o ConnectTimeout=5 -p "${remote_port}" "${remote_host}" exit 2>/dev/null; then
echo "SSH key for ${key_name} is already deployed ✓" echo "SSH key for ${host_name} is already deployed ✓"
return 0 return 0
fi fi
@@ -144,19 +149,20 @@ setup_ssh_key() {
read -p "Deploy SSH key to ${remote_host}? [y/N] " -n 1 -r read -p "Deploy SSH key to ${remote_host}? [y/N] " -n 1 -r
echo echo
if [[ $REPLY =~ ^[Yy]$ ]]; then if [[ $REPLY =~ ^[Yy]$ ]]; then
ssh-copy-id -i "${key_file}.pub" -p "${remote_port}" "${remote_host}" ssh-copy-id -i "${KEY_FILE}.pub" -p "${remote_port}" "${remote_host}"
return 0
else else
echo "Skipping ${key_name} key deployment" echo "Skipping ${host_name} key deployment"
return 1 return 1
fi fi
} }
# Setup homelab key # Setup homelab
setup_ssh_key "homelab" "homelab" 22 deploy_ssh_key "homelab" "homelab" 22
HOMELAB_OK=$? HOMELAB_OK=$?
# Setup ESRF key # Setup ESRF
setup_ssh_key "esrf" "dehaeze@firewall.esrf.fr" 8022 deploy_ssh_key "esrf" "dehaeze@firewall.esrf.fr" 8022
ESRF_OK=$? ESRF_OK=$?
echo "==> Tangling systemd configs" echo "==> Tangling systemd configs"