search

keybase / bot-sshca

A chat bot that can manage your team's SSH accounts
BSD 3-Clause "New" or "Revised" License
222 stars 30 forks source link

add to actually delete all config files when the service is stopped #96

Closed mmou closed 4 years ago

mmou commented 4 years ago

I don't know if this ever worked, but my kssh config files were not getting deleted on docker kill of the keybaseca container. Issue #86 mentions the same problem. (Note my files do get properly deleted if I'm in the container and only kill the keybaseca process.)

This is because docker kill sends a SIGKILL only to the process with pid1, and that process wasn't forwarding the signal to the keybaseca process. Adding --init to docker run makes it such that an init process based on tini is run as pid 1, that will properly reap zombie processes. But the problem here is that even if we are able to properly propagate the signal to keybaseca, keybaseca needs kbfsfuse to stay alive long enough to actually delete the config files. So at this point...I decided to try another approach of just starting another docker container to delete all config files, before killing all ca-related containers.

make clean-kssh will delete all config files that the CA Keybase account can find. This will only mess you up if for some reason, you have another CA bot simultaneously running that is listening on and signing keys for the same teams -- this seems really unlikely, and if you are in this situation, you can just restart your other CA bot to rewrite the kssh files.

ddworken commented 4 years ago

LGTM 👍

I suspect you're right that the config file clearing didn't work correctly all along, so thanks for fixing it!