Add mechanism for copying certificates to other servers.

pillar/secrets/certificates.sls.sample

@@ -0,0 +1,9 @@
+certificates:
+  ssh_key: |
+    -----BEGIN OPENSSH PRIVATE KEY-----
+    AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
+    BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB
+    CCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC
+    DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
+    EEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEEE==
+    -----END OPENSSH PRIVATE KEY-----

pillar/top.sls

@@ -1,4 +1,6 @@
 base:
+  'hedwig.lunch.org.uk':
+    - secrets/certificates
   'scabbers.lunch.org.uk':
     - secrets/dnsapi
     - secrets/gitea

states/certificates/certificates_id_ed25519.pub

@@ -0,0 +1 @@
+command="/usr/bin/rrsync -ro /var/lib/dehydrated/certs",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPBYX4DObffj3doqTEy5XawgEH2QT3WzAtHtUfrRhaWA jim@lunch.org.uk

states/certificates/client.sls

@@ -0,0 +1,23 @@
+certificates_client:
+  pkg.installed:
+  - pkgs:
+    - rsync
+
+var_local_certificates_dir:
+  file.directory:
+    - name: /var/local/certificates
+    - user: root
+    - group: root
+    - mode: 0700
+
+certificates_key:
+  file.managed:
+    - name: /var/local/certificates/certificates_id_e25519
+    - mode: 0600
+    - contents_pillar: certificates:ssh_key
+
+client_cron:
+  file.managed:
+    - name: /etc/cron.daily/certificates
+    - source: salt://certificates/client_cron.daily
+    - mode: '0755'

states/certificates/client_cron.daily

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec rsync -a -e "ssh -i /var/local/certificates/certificates_id_e25519 -o StrictHostKeyChecking=no" root@scabbers.lunch.org.uk:/ /var/local/certificates/

states/certificates/init.sls

@@ -3,6 +3,7 @@ dehydrated:
   - pkgs:
     - dehydrated
     - dnsutils
+    - rsync
 
 dehydrated_domains:
   file.managed:
@@ -46,3 +47,7 @@ dehydrated_logrotate:
     - source: salt://certificates/dehydrated/logrotate
     - mode: '0644'
 
+server_key:
+  ssh_auth.present:
+    - user: root
+    - source: salt://certificates/certificates_id_ed25519.pub

states/top.sls

@@ -3,6 +3,7 @@ base:
     - common
   
   'hedwig.lunch.org.uk':
+    - certificates/client
     - debian
     - fail2ban
     - firewalls/hedwig