Skip to content

Commit d71ac97

Browse files
delanodelano
authored
Merge pull request #14 from onetimesecret/feature/plugin
Fix image/asset ENV var resolution bugs, add xcaddy cloud-init support
2 parents 715be99 + 39ee206 commit d71ac97

24 files changed

+3376
-97
lines changed

‎.github/workflows/claude-code-review.yml‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,15 @@ jobs:
2323
# github.event.pull_request.author_association == 'FIRST_TIME_CONTRIBUTOR'
2424
# if: ${{ !startsWith(github.head_ref, 'deps/') }}
2525
runs-on: ubuntu-latest
26-
if: |
27-
(github.event.action == 'opened') ||
28-
(github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
29-
(github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
26+
# Skip bot-created PRs (renovate, dependabot, etc.) - they show as 'name[bot]' in github.actor
27+
if: ${{
28+
!endsWith(github.actor, '[bot]') &&
29+
(
30+
(github.event.action == 'opened') ||
31+
(github.event.action == 'labeled' && github.event.label.name == 'claude-review') ||
32+
(github.event.action == 'synchronize' && contains(github.event.pull_request.labels.*.name, 'claude-review'))
33+
)
34+
}}
3035

3136
permissions:
3237
contents: read

‎docs/wips/0205-00-environment-configuration-skeleton.md‎

Lines changed: 340 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,340 @@
1+
2+
# Environment Configuration Skeleton
3+
4+
These are the actual file listings from the main dev/operations workstation.
5+
6+
```bash
7+
$ lsd --tree --dereference ~/.ssh
8+
.
9+
├──  authorized_keys
10+
├──  config
11+
├──  ctrlmasters
12+
├──  id_ed25519
13+
├── 󰌆 id_ed25519-plaintiff-generated.pem
14+
├── 󰌆 id_ed25519.pub
15+
├──  id_rsa-lal
16+
├── 󰌆 id_rsa-lal.pub
17+
├──  known_hosts
18+
├── 󰁯 known_hosts.old
19+
├──  onetime
20+
│ ├──  config
21+
│ ├──  config-demo.md
22+
│ ├──  demos
23+
│ │ ├──  config
24+
│ │ ├──  id_ed25519-ul-demokeys
25+
│ │ └── 󰌆 id_ed25519-ul-demokeys.pub
26+
│ ├──  ge
27+
│ ├──  ge-config
28+
│ ├──  id_ed25519
29+
│ ├──  id_ed25519-fulton-ploptart
30+
│ ├── 󰌆 id_ed25519-fulton-ploptart.pub
31+
│ ├──  id_ed25519-plaintiff
32+
│ ├── 󰌆 id_ed25519-plaintiff.pub
33+
│ ├──  id_ed25519-do
34+
│ ├──  id_ed25519-do-uqcyu
35+
│ ├── 󰌆 id_ed25519-do-uqcyu.pub
36+
│ ├── 󰌆 id_ed25519-do.pub
37+
│ ├──  id_ed25519-lal
38+
│ ├── 󰌆 id_ed25519-lal.pub
39+
│ ├── 󰌆 id_ed25519.pub
40+
│ ├──  id_rsa-plaintiff
41+
│ ├── 󰌆 id_rsa-plaintiff.pub
42+
│ └──  production
43+
│ ├──  config
44+
│ ├──  id_ed25519-ploptart-infra
45+
│ ├── 󰌆 id_ed25519-ploptart-infra.pub
46+
│ ├──  id_ed25519-bananahat
47+
│ └── 󰌆 id_ed25519-bananahat.pub
48+
├── 󰌆 van.2024-03-16.private-key.pem
49+
```
50+
51+
### SSH Config
52+
53+
One of our actual SSH config files. Each host has a unique IP address associated to it (redacted). In some environments the web instances acts as a jumphost for the DB instance which only has an internal private network IP address.
54+
55+
```bash
56+
$ cat .ssh/onetime/config
57+
58+
##
59+
# Wildcard settings are applied at the end. From the manual:
60+
#
61+
# "Since the first obtained value for each parameter is
62+
# used, more host-specific declarations should be given
63+
# near the beginning of the file, and general defaults
64+
# at the end." -- `$ man 1 ssh`
65+
#
66+
67+
# ------------------------------------------- PRODUCTION ---
68+
69+
70+
# NZ (Por)
71+
#
72+
Host nz-por-web-01 nz-web1
73+
IdentityFile ~/.ssh/onetime/id_rsa-plaintiff
74+
Port 22
75+
User appuser
76+
77+
Host nz-por-redis-01 nz-redis
78+
# IdentityFile ~/.ssh/onetime/id_ed25519
79+
IdentityFile ~/.ssh/onetime/id_rsa-plaintiff
80+
Port 22
81+
User appuser
82+
ProxyCommand ssh nz-por-web-01 exec nc %h %p
83+
84+
#
85+
# CA (Toronto)
86+
#
87+
Host ca-tor-web-02 ca-web2
88+
# IdentityFile ~/.ssh/onetime/id_ed25519
89+
IdentityFile ~/.ssh/onetime/id_ed25519-do
90+
Port 22
91+
# User root
92+
User appuser
93+
94+
Host ca-tor-web-01 ca-web1
95+
# IdentityFile ~/.ssh/onetime/id_ed25519
96+
IdentityFile ~/.ssh/onetime/id_ed25519-do
97+
Port 22
98+
# User root
99+
User appuser
100+
101+
Host ca-tor-redis-01 ca-redis
102+
# IdentityFile ~/.ssh/onetime/id_ed25519
103+
IdentityFile ~/.ssh/onetime/id_ed25519-do
104+
Port 22
105+
User appuser
106+
107+
108+
#
109+
# EU
110+
#
111+
Host ab-noro-sentry ab-sentry sentry
112+
IdentityFile ~/.ssh/onetime/id_ed25519
113+
IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
114+
Port 22
115+
User appuser
116+
117+
Host ab-noro-proxy-01 ab-proxy
118+
IdentityFile ~/.ssh/onetime/id_ed25519
119+
#IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
120+
Port 22
121+
User appuser
122+
123+
Host ab-noro-web-02 ab-web2
124+
IdentityFile ~/.ssh/onetime/id_ed25519
125+
IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
126+
Port 22
127+
User appuser
128+
129+
Host ab-noro-redis-01 ab-redis
130+
IdentityFile ~/.ssh/onetime/id_ed25519
131+
ProxyCommand ssh ab-noro-web-02 exec nc %h %p
132+
Port 22
133+
User appuser
134+
135+
#
136+
# US
137+
#
138+
Host ts-lana-webdirect-01 ts-webdirect1
139+
IdentityFile ~/.ssh/onetime/id_ed25519
140+
IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
141+
Port 22
142+
User appuser
143+
144+
Host ts-lana-web-01 ts-web1
145+
IdentityFile ~/.ssh/onetime/id_ed25519
146+
IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
147+
Port 22
148+
User appuser
149+
150+
Host ts-lana-redis-01 ts-redis1
151+
IdentityFile ~/.ssh/onetime/id_ed25519
152+
IdentityFile ~/.ssh/onetime/id_ed25519-fulton-ploptart
153+
ProxyCommand ssh ts-lana-web-01 exec nc %h %p
154+
Port 22
155+
User appuser
156+
157+
158+
# ------------------------------------------- DEMOS ---
159+
160+
161+
Host ab-demos-web ab-logto
162+
HostName ab-demos-web.internal
163+
164+
Host ab-demos-db ab-demos-maindb ab-demos-authdb ab-demos-mq
165+
HostName ab-demos-db.internal
166+
ProxyCommand ssh ab-demos-web exec nc %h %p
167+
168+
169+
Host ab-demos-*
170+
IdentityFile ~/.ssh/onetime/id_ed25519
171+
IdentityFile ~/.ssh/onetime/demos/id_ed25519-ul-demokeys
172+
Port 22
173+
User appuser
174+
#User root
175+
176+
# Prevent forwarding locale environment variables to remote hosts
177+
# This avoids locale-related warnings when connecting to servers
178+
# without the client's locale settings installed
179+
SendEnv -LANG -LC_*
180+
UseKeychain yes
181+
AddKeysToAgent yes
182+
ForwardAgent yes
183+
184+
# Specifies that ssh should only use identity keys
185+
# configured in the ssh configuration files, and not
186+
# use any identities stored in the ssh-agent.
187+
IdentitiesOnly yes
188+
189+
190+
# fly ssh issue --agent [org] [path] [flags]
191+
# Just run redis-insight locally instead of in docker. SSH is denied when its
192+
# just the agent. Need to write the .pem file and run with:
193+
#
194+
# $ ssh -i ./poop.pem ots-staging-redis
195+
#
196+
Host ots*
197+
IdentityFile ~/.ssh/onetime/id_ed25519
198+
User root
199+
200+
Host onetim* ots* ab-* ts-* ca-* nz-* au-* uk-* jp-*
201+
# Prevent forwarding locale environment variables to remote hosts
202+
# This avoids locale-related warnings when connecting to servers
203+
# without the client's locale settings installed
204+
SendEnv -LANG -LC_*
205+
UseKeychain yes
206+
AddKeysToAgent yes
207+
ForwardAgent yes
208+
209+
# Specifies that ssh should only use identity keys
210+
# configured in the ssh configuration files, and not
211+
# use any identities stored in the ssh-agent.
212+
IdentitiesOnly yes
213+
214+
215+
### Environment COnfiguration
216+
217+
Each environment represents a group of VPS instances that run onetime secret.
218+
219+
220+
```bash
221+
$ lsd --tree --dereference
222+
 environments
223+
├──  ca
224+
│ ├──  config-v0.23
225+
│ │ ├──  Caddyfile.template
226+
│ │ └──  config.yaml
227+
│ ├──  config-v0.24
228+
│ │ ├──  billing.yaml
229+
│ │ ├──  Caddyfile.template
230+
│ │ ├──  cloud-config-web.yaml
231+
│ │ └──  config.yaml
232+
│ └──  init
233+
│ ├──  prepare-cloud-init.sh
234+
│ └──  redis.conf
235+
├──  demos
236+
│ └──  eu
237+
│ ├──  Caddyfile-lite.template
238+
│ ├──  Caddyfile.template
239+
│ ├──  cloud-config-db.yaml
240+
│ ├──  cloud-config-web.yaml
241+
│ ├──  cloud-config.yaml
242+
│ ├──  config-lite.yaml
243+
│ ├──  config-v0.24
244+
│ │ ├──  auth.yaml
245+
│ │ ├──  billing.yaml
246+
│ │ ├──  Caddyfile.template
247+
│ │ ├──  config.yaml
248+
│ │ ├──  logging.yaml
249+
│ │ └──  puma.rb
250+
│ ├──  config.yaml
251+
│ ├──  jumphost_key
252+
│ ├── 󰌆 jumphost_key.pub
253+
│ ├──  logto
254+
│ │ ├──  INSTALL-podman.md
255+
│ │ └──  INSTALL-systemd.md
256+
│ ├──  oauth2-proxy
257+
│ │ ├──  oauth2-proxy.env
258+
│ │ ├──  oauth2-proxy.service
259+
│ │ ├──  oauth2-proxy.socket
260+
│ │ ├──  README-systemd-socket-units.md
261+
│ │ ├──  README.html
262+
│ │ └──  README.md
263+
│ ├──  prepare-cloud-init-db.sh
264+
│ ├──  prepare-cloud-init-web.sh
265+
│ ├──  README-sso-decision-framework.md
266+
│ ├──  README.md
267+
│ ├──  redis.conf
268+
│ └──  zitadel
269+
│ ├──  PODMAN.md
270+
│ ├──  README-socks-proxy.md
271+
│ ├──  README-sso-handoff.md
272+
│ └──  SETUP-onetimesecret.md
273+
├──  dev
274+
│ └──  caddy
275+
│ ├──  Caddyfile
276+
│ └──  Caddyfile-alt-of-unknown-provinence
277+
├──  eu
278+
│ ├──  config-v0.23
279+
│ │ ├──  Caddyfile.template
280+
│ │ ├──  config.yaml
281+
│ │ └──  redis.conf
282+
│ ├──  config-v0.24
283+
│ │ └──  billing.yaml
284+
│ ├──  init
285+
│ │ └──  prepare-cloud-init.sh
286+
│ └──  proxy
287+
│ ├──  cloud-config-proxy-01.yaml
288+
│ ├──  official-notes.md
289+
│ ├──  proxy-connect-notes.txt
290+
│ └──  sentry
291+
│ └──  docker-compose.yml
292+
├──  infra
293+
│ └──  container-registry
294+
│ └──  cloud-init.yaml
295+
├──  nz
296+
│ ├──  config-v0.23
297+
│ │ ├──  Caddyfile.template
298+
│ │ ├──  config.yaml
299+
│ │ └──  redis.conf
300+
│ ├──  config-v0.24
301+
│ │ └──  billing.yaml
302+
│ ├──  init
303+
│ │ ├──  cloud-config-redis.yaml
304+
│ │ ├──  cloud-config-web.yaml
305+
│ │ └──  prepare-cloud-init.sh
306+
│ └──  openrc-script.sh
307+
├──  uk
308+
│ ├──  config-v0.24
309+
│ │ ├──  auth.yaml
310+
│ │ ├──  billing.yaml
311+
│ │ ├──  Caddyfile.template
312+
│ │ ├──  config.yaml
313+
│ │ ├──  logging.yaml
314+
│ │ └──  puma.rb
315+
│ └──  init
316+
│ ├──  cloud-init-db.yaml
317+
│ ├──  cloud-init-web.yaml
318+
│ ├──  README.md
319+
│ └──  bananahat-dns.md
320+
└──  us
321+
├──  allowed-domains
322+
│ ├──  allowed-domains.py
323+
│ ├──  customer-how-to-guide-code-sonnet.md
324+
│ ├──  customer-how-to-guide-k2.md
325+
│ ├──  domains.txt
326+
│ ├──  internal-about-cf-for-saas.md
327+
│ ├──  internal-code-sonnet.md
328+
│ └──  internal-gunicorn-setup.md
329+
├──  config-v0.23
330+
│ ├──  Caddyfile-webdirect.template
331+
│ ├──  Caddyfile.template
332+
│ ├──  config.yaml
333+
│ └──  redis.conf
334+
├──  config-v0.24
335+
│ ├──  billing.yaml
336+
│ └──  config.yaml
337+
└──  init
338+
├──  cloud-config-hillsboro-webdirect.yaml
339+
└──  prepare-cloud-init.sh
340+
```

0 commit comments

Comments
 (0)