ci: deploy to woco.dev as reese user with dedicated WOCO_DEV_SSH_KEY#78
Closed
reese8272 wants to merge 2 commits into
Closed
ci: deploy to woco.dev as reese user with dedicated WOCO_DEV_SSH_KEY#78reese8272 wants to merge 2 commits into
reese8272 wants to merge 2 commits into
Conversation
DEPLOY_SSH_KEY is authorized on hellowoco.app (wocod) but not woco.dev (root). Separate secret lets Reese load his own key there independently. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Root SSH logins for automated processes violate security best practice. WOCO_DEV_SSH_KEY must be a dedicated deploy key, not a personal key. Box prereq: reese user in sudo group with key in authorized_keys. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Author
|
Closing as superseded. Staging's current CI (build-and-deploy.yml / deploy-prod.yml) already deploys as wocod directly with dedicated STAGING_DEPLOY_SSH_KEY / PROD_DEPLOY_SSH_KEY and scoped sudo -n — a stronger design than reese+WOCO_DEV_SSH_KEY proposed here (and it matches Michael's 'wocod deploys on both boxes'). The stale-docs remnant is handled in #82. Follow-up worth doing on the boxes: remove the old root deploy key from /root/.ssh/authorized_keys and delete the retired DEPLOY_SSH_KEY / WOCO_DEV_SSH_KEY repo secrets if present. |
grubermeister
pushed a commit
that referenced
this pull request
Jul 3, 2026
…del (#82) Successor to PRs #77 and #78, whose payloads are now superseded: - #77 (default push_data.sh host to reese@) — superseded by #79, which removes the username default entirely per Michael's instruction. - #78 (CI deploy as reese + WOCO_DEV_SSH_KEY) — superseded by staging's own rework: CI now SSHes directly as wocod with dedicated STAGING/PROD_DEPLOY_SSH_KEY keys and scoped sudo -n, which is stronger. What remained true from their intent is that the docs still described the old root-deploy world: STAGING_WOCO_DEV.md told operators to push data as root@woco.dev and AUTH_SYNC.md to scp as root@ — both impossible now that root login is disabled, and contrary to the deploy model. Updated to <your-user>@ with notes that files still land owned by wocod, and marked the provisioning section's root SSH as initial-setup-only. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
reese(sudo group) instead ofroot— automated root logins violate security best practice; a healthy box has no root sessionsWOCO_DEV_SSH_KEY) from the prod deploy secret (DEPLOY_SSH_KEY) so compromising one doesn't affect the othersudoprefixes tosystemctl,chown, andinstallcalls that previously ran as root directlyPrerequisites (all done)
reeseuser exists on woco.dev with key inauthorized_keysandNOPASSWDsudoPermitRootLogin no)WOCO_DEV_SSH_KEYGitHub secret set to dedicated deploy key (not personal key)Test plan
stagingand confirm CI deploys successfully to woco.devssh root@172.238.189.147is denied🤖 Generated with Claude Code