wangbo
f5b6ff72f2
将包含空格与注释的 Ed25519 host key、公钥先 Base64 编码为单个 SSH 参数，远端解码后再次校验，并清理前次失败产生的无效 authorized_keys 单词行。 验证：Base64 完整往返、bash -n、ShellCheck，两次首次连接失败现场。
68 lines
2.4 KiB
Bash
Executable File
68 lines
2.4 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
script_dir=$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)
|
|
# shellcheck source=scripts/cluster/common.sh
|
|
source "$script_dir/common.sh"
|
|
load_cluster_env
|
|
|
|
hongkong_host_key=$(cluster_ssh "$CLUSTER_HONGKONG_HOST" \
|
|
"cut -d ' ' -f 1,2 /etc/ssh/ssh_host_ed25519_key.pub")
|
|
[[ $hongkong_host_key =~ ^ssh-ed25519\ [A-Za-z0-9+/]+={0,2}$ ]] || {
|
|
echo 'invalid Hong Kong SSH host key' >&2
|
|
exit 1
|
|
}
|
|
hongkong_host_key_b64=$(printf '%s' "$hongkong_host_key" | base64 | tr -d '\n')
|
|
|
|
public_key=$(cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
install -d -m 0700 /root/.ssh
|
|
if [[ ! -f /root/.ssh/id_ed25519_easyai_cert_sync ]]; then
|
|
ssh-keygen -q -t ed25519 -N '' -f /root/.ssh/id_ed25519_easyai_cert_sync
|
|
fi
|
|
cat /root/.ssh/id_ed25519_easyai_cert_sync.pub
|
|
REMOTE
|
|
)
|
|
[[ $public_key == ssh-ed25519\ * ]] || {
|
|
echo 'invalid certificate sync public key' >&2
|
|
exit 1
|
|
}
|
|
public_key_b64=$(printf '%s' "$public_key" | base64 | tr -d '\n')
|
|
cluster_ssh "$CLUSTER_HONGKONG_HOST" bash -s -- "$public_key_b64" <<'REMOTE'
|
|
set -euo pipefail
|
|
public_key=$(printf '%s' "$1" | base64 -d)
|
|
[[ $public_key == ssh-ed25519\ * ]]
|
|
install -d -m 0700 /root/.ssh
|
|
touch /root/.ssh/authorized_keys
|
|
chmod 0600 /root/.ssh/authorized_keys
|
|
sed -i '/^ssh-ed25519$/d' /root/.ssh/authorized_keys
|
|
grep -Fqx "$public_key" /root/.ssh/authorized_keys || printf '%s\n' "$public_key" >>/root/.ssh/authorized_keys
|
|
REMOTE
|
|
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" bash -s -- "$hongkong_host_key_b64" <<'REMOTE'
|
|
set -euo pipefail
|
|
hongkong_host_key=$(printf '%s' "$1" | base64 -d)
|
|
[[ $hongkong_host_key == ssh-ed25519\ * ]]
|
|
install -d -m 0700 /root/.ssh
|
|
known_hosts=/root/.ssh/known_hosts
|
|
temporary=$(mktemp /root/.ssh/known_hosts.XXXXXX)
|
|
if [[ -f $known_hosts ]]; then
|
|
grep -Ev '^10\.77\.0\.2([ ,]|$)' "$known_hosts" >"$temporary" || true
|
|
fi
|
|
printf '10.77.0.2 %s\n' "$hongkong_host_key" >>"$temporary"
|
|
chmod 0600 "$temporary"
|
|
mv "$temporary" "$known_hosts"
|
|
REMOTE
|
|
|
|
cluster_scp "$script_dir/sync-nginx-certificate.sh" \
|
|
"$CLUSTER_NINGBO_HOST:/usr/local/sbin/easyai-sync-nginx-certificate"
|
|
cluster_ssh "$CLUSTER_NINGBO_HOST" 'bash -s' <<'REMOTE'
|
|
set -euo pipefail
|
|
chmod 0750 /usr/local/sbin/easyai-sync-nginx-certificate
|
|
install -d -m 0755 /etc/letsencrypt/renewal-hooks/deploy
|
|
ln -sfn /usr/local/sbin/easyai-sync-nginx-certificate \
|
|
/etc/letsencrypt/renewal-hooks/deploy/easyai-sync-nginx-certificate
|
|
/usr/local/sbin/easyai-sync-nginx-certificate
|
|
REMOTE
|
|
echo 'certificate_sync_install=PASS'
|