search

caktus / tequila-common

Ansible role for setting up users, keys, directories, and a firewall for a Django server
BSD 3-Clause "New" or "Revised" License
1 stars 1 forks source link

Add support for setting the project user's private key #14

Closed copelco closed 6 years ago

copelco commented 6 years ago

GitHub deploy keys only grant access to a single repository. Sometimes a project may require access to several different private GitHub repos. For example, if a pip requirements file references several private Git repos. GitHub suggests using a Machine User in this scenario.

This PR proposes to allow specification of the project user's private SSH key from ansible vault. Then any git pull (whether invoked directly by git or within pip) will use this SSH key.

dpoirier commented 6 years ago

It makes me uneasy to distribute my private key to any server I deploy to. Also, if devs are following our security policy, we'll have passphrases set on our key files and this won't work.

I'm wondering about instead trying to get agent forwarding to work, as mentioned here https://www.calazan.com/using-ssh-agent-forwarding-with-ansible/. I'm going to see how hard that is.

copelco commented 6 years ago

Agreed - I think #15 handles this better