From a0915be2d060d529ead265c37b7159199bfe42af Mon Sep 17 00:00:00 2001
From: Rob Austein <sra@build-u.rpki.net>
Date: Fri, 29 Jul 2016 21:57:31 +0000
Subject: Whack with club until builds work with new repository and scripts.

---
 rpki-pbuilder.ssh_config | 34 ++++++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 rpki-pbuilder.ssh_config

(limited to 'rpki-pbuilder.ssh_config')

diff --git a/rpki-pbuilder.ssh_config b/rpki-pbuilder.ssh_config
new file mode 100644
index 0000000..6084fc1
--- /dev/null
+++ b/rpki-pbuilder.ssh_config
@@ -0,0 +1,34 @@
+# Fake hostnames here correspond to git remote URLs, which turns out
+# to be the easy way to use separate keys for push and fetch:
+#
+#   $ git remote -v
+#   origin  pull.download.rpki.net:/usr/local/git/repositories/rpki.net.git/ (fetch)
+#   origin  push.download.rpki.net:/usr/local/git/repositories/rpki.net.git/ (push)
+#
+# The third key is used for rsync daemon-mode-over-ssh, as the name suggests:
+#
+#   $ rsync --rsh ssh rsync://download.rpki.net/
+#   APT    APT repository for old stable RPKI code (trunk)
+#   APTng  APT repository for new development RPKI code
+#
+# The reason for using three separate keys is simple: this is a robot, keys are cheap,
+# and using a separate key for each allowed action gives us a trivial way to lock down
+# the server side.
+
+Host pull.download.rpki.net
+    HostName download.rpki.net
+    User aptbot
+    IdentityFile ~/.ssh/id_rsa_pull
+    IdentitiesOnly yes
+
+Host push.download.rpki.net
+    HostName download.rpki.net
+    User aptbot
+    IdentityFile ~/.ssh/id_rsa_push
+    IdentitiesOnly yes
+
+Host download.rpki.net
+    HostName download.rpki.net
+    User aptbot
+    IdentityFile ~/.ssh/id_rsa_rsync
+    IdentitiesOnly yes
-- 
cgit v1.2.3