vh
3e634bb3d0
Satellite agents get their OWN key under the infra-ops identity instead of a copy of the fleet key, so one can be revoked by deleting a line. The list is playbooks/files/infra-ops-satellite-keys (target short hostname + public key). bootstrap-infra-ops-user.yaml now writes the fleet key plus that host's satellite keys, exactly, so a re-run keeps listed keys and removes unlisted ones. satellite-1 (SHA256:KEFUjceF...) is authorized on esh-nas only (Prime, 2026-10-13); the playbook re-run there installed both keys, and the fleet key still logs in with sudo.
10 lines
820 B
Plaintext
10 lines
820 B
Plaintext
# Satellite agents' own keys for the infra-ops identity, scoped PER HOST (Prime 2026-10-13).
|
|
# Format: <target's `hostname -s`> <public key line>. playbooks/bootstrap-infra-ops-user.yaml writes the fleet key
|
|
# plus every line here whose first field matches the target's short hostname. Nothing else survives, so a key
|
|
# that is not listed here is removed on the next run. Revoke a satellite by deleting its line(s) and re-running
|
|
# the playbook on those hosts. Public keys only: never put a private key in this repo.
|
|
#
|
|
# satellite-1: generated by Prime on his satellite machine 2026-10-13, fingerprint
|
|
# SHA256:KEFUjceFjuIZDuVbEq3FWYHm0rzdqx9hC+wFrA5h3xc (its own comment was "infra-ops@", with no hostname).
|
|
esh-nas ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIL0XLLZVTJUTgrWbMAx5exF3UDqPdi/30l/1lRo6d4bt infra-ops@satellite-1
|