marchon/system-git-sync
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

S27: deploy creates npe-dir endpoint keys and systemd KEYDIR
Some checks are pending
review / inventory (push) Waiting to run
Details

Browse source
This commit is contained in:
George Lambert 2026-09-15 23:43:11 -04:00
parent 185cdaabdb
commit 548d9967d5
3 changed files with 46 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

36
cicd/deploy-ns1.sh
View file

@ -82,6 +82,42 @@ sudo tee /etc/systemd/system/pfc-repl-b.service.d/nats-psk.conf >/dev/null << 'U
[Service]
EnvironmentFile=-/opt/pfc/etc/nats.env
UNIT
# Public-key directory + per-endpoint HPKE keys (private 0600, public listed)
sudo python3 - << 'PY'
import sys
sys.path.insert(0, "/opt/pfc/python")
from pathlib import Path
from secure_messaging.pubkey_dir import PubKeyDir
d = PubKeyDir(Path("/opt/pfc/etc/npe-dir"))
for h in ("pfc-admin", "pfc-repl", "pfc-repl-a", "pfc-repl-b", "pfc-ipfs", "sm-leaf"):
if d.get(h) is None:
d.create_endpoint(h)
print("created", h)
else:
print("exists", h)
print("handles", d.available()["handles"])
PY
sudo chmod 700 /opt/pfc/etc/npe-dir/private
sudo tee /etc/systemd/system/pfc-py-admin.service.d/npe-dir.conf >/dev/null << 'UNIT'
[Service]
Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
Environment=PFC_NPE_HANDLE=pfc-admin
UNIT
sudo tee /etc/systemd/system/pfc-repl.service.d/npe-dir.conf >/dev/null << 'UNIT'
[Service]
Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
Environment=PFC_NPE_HANDLE=pfc-repl
UNIT
sudo tee /etc/systemd/system/pfc-repl-a.service.d/npe-dir.conf >/dev/null << 'UNIT'
[Service]
Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
Environment=PFC_NPE_HANDLE=pfc-repl-a
UNIT
sudo tee /etc/systemd/system/pfc-repl-b.service.d/npe-dir.conf >/dev/null << 'UNIT'
[Service]
Environment=PFC_KEYDIR=/opt/pfc/etc/npe-dir
Environment=PFC_NPE_HANDLE=pfc-repl-b
UNIT
sudo mkdir -p /opt/pfc/python/secure_messaging /opt/pfc/python/admin/pfc_admin /opt/pfc/python/lib
sudo rsync -a /tmp/secure_messaging/ /opt/pfc/python/secure_messaging/
sudo rsync -a /tmp/pfc_admin/ /opt/pfc/python/admin/pfc_admin/