feat/tailscale-vault-autojoin #128

Merged
clawdie merged 2 commits from feat/tailscale-vault-autojoin into main 2026-06-24 10:02:13 +02:00
Showing only changes of commit a03c4a6b54 - Show all commits

View file

@ -515,8 +515,8 @@ check_release_gate() {
# A baked mother SSH private key must never reach a publicly hosted release
# image. Fail fast here so a release build aborts in seconds; the image
# assembly step also refuses to copy it, as defense in depth.
if [ -f "/home/clawdie/.ssh/osa-mother-2026" ]; then
echo "ERROR: mother SSH key present on build host (/home/clawdie/.ssh/osa-mother-2026) — refuse to bake it into a release image. Remove it, or build with BUILD_CHANNEL=dev."
if [ -f "/home/clawdie/.ssh/mother-mcp" ]; then
echo "ERROR: mother SSH key present on build host (/home/clawdie/.ssh/mother-mcp) — refuse to bake it into a release image. Remove it, or build with BUILD_CHANNEL=dev."
_release_errors=$(( _release_errors + 1 ))
fi
@ -1736,13 +1736,13 @@ EOF
# Pre-stage mother connectivity key if present on the build host.
# Lets the live USB node SSH into the mother server (osa) without
# manual key exchange. Public key is already in mother authorized_keys.
_mother_key_src="/home/clawdie/.ssh/osa-mother-2026"
_mother_key_src="/home/clawdie/.ssh/mother-mcp"
if [ -f "${_mother_key_src}" ]; then
[ "${BUILD_CHANNEL}" = "release" ] && { echo "ERROR: refusing to bake mother SSH key into a release image"; exit 1; }
mkdir -p "${MOUNT_POINT}/home/clawdie/.ssh"
cp "${_mother_key_src}" "${MOUNT_POINT}/home/clawdie/.ssh/osa-mother-2026"
chmod 0600 "${MOUNT_POINT}/home/clawdie/.ssh/osa-mother-2026"
cp "${_mother_key_src}" "${MOUNT_POINT}/home/clawdie/.ssh/mother-mcp"
chmod 0600 "${MOUNT_POINT}/home/clawdie/.ssh/mother-mcp"
echo " Staged mother SSH key for USB→mother connectivity."
fi
chmod 0755 \