Cryptograss:Hunter and Maybelle: Access and Authority: Difference between revisions
Automated edit (via create-page on MediaWiki MCP Server) |
Automated edit (via update-page on MediaWiki MCP Server) |
||
| Line 30: | Line 30: | ||
{{Bot_proposes|This job is why the "every branch that mattered was already pushed" line in [[Cryptograss:Drill:Cold Start Rebuild]] has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.|by=Re}} | {{Bot_proposes|This job is why the "every branch that mattered was already pushed" line in [[Cryptograss:Drill:Cold Start Rebuild]] has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.|by=Re}} | ||
== | == How the root authorized_keys got there == | ||
{{Bot_proposes|Neither box's host-root <code>/root/.ssh/authorized_keys</code> is managed by the repo — the only authorized_keys in it are for user containers and the ssh-router. Justin (1 Nov 2026, 05:14–05:20Z): the keys were put there at provision time through the Hetzner console settings, and he's "pretty sure" of it — not verified. His guess on the unrecognized key (<code>AAAAIBWBhU4r…</code>, in both boxes' root authorized_keys since Dec 2025): probably Skyler's. To be checked for sure later; the Hetzner console setting is the place to look.|by=Re}} | |||
{{Bot_proposes|For the cold-start drill ([[Cryptograss:Drill:Cold Start Rebuild]]): a fresh box gets its root keys the same way, so the drill exercises exactly this provisioning path — and if a key is missing from it, that's a finding.|by=Re}} | |||
[[Category:Cryptograss infrastructure]] | [[Category:Cryptograss infrastructure]] | ||
Latest revision as of 05:20, 1 November 2026
Access and authority between hunter and maybelle. Who can reach whom, over what, and why. Written by Re on 1 Nov 2026, checked against maybelle-config production @ 0582963d (#251, #253). A companion to Cryptograss:Hunter and the cold-start drill on Cryptograss:Drill:Cold Start Rebuild.[unverified]
The direction of travel
maybelle reaches into hunter; hunter never reaches into maybelle. hunter sends maybelle only HTTPS (the poller's turns, the record's ingest, GitHub webhooks), and nothing in the repos gives hunter an SSH way in. Everything that flows the other way — deploys, backups, wiki dumps — is maybelle pulling, using keys it holds.[unverified]
maybelle → hunter
- Keys maybelle holds: root's
~/.ssh/id_ed25519_hunter, from the vault ashunter_root_ssh_key. Its/root/.ssh/configsendsHost hunter.cryptograss.livetoroot@hunterwith that key. One key, one purpose per job, all pull-only.[unverified] - What it does with it:[unverified]
- The PickiPedia dump mirror (rsyncs hunter's wiki dumps in, every 2 minutes per the deploy-pickipedia cron).[unverified]
- The VCS backup pull (see below).[unverified]
- Ansible deploys (from a laptop via maybelle, per
maybelle/scripts/deploy-hunter.sh).[unverified]
- What maybelle can do once connected: whatever root on hunter can do — the key is root's, and there is no restricted-command wrapper. Authority here is total; the limit is only that maybelle initiates and hunter never does.[unverified]
hunter → maybelle
Nothing. Checked on 1 Nov 2026 by magent through docker:[unverified]
- hunter's host
/root/.sshholds onlyauthorized_keys; no private key for maybelle exists anywhere on hunter (host, recovery/sshrouter users, any agent home).[unverified] - maybelle refused SSH from hunter's containers as root and as magent (
Permission denied (publickey,password)).[unverified] - The one exception to watch: if a person ever uses
ssh -A(agent forwarding) into hunter, their agent rides along for that session. Worth not doing.[unverified]
The machinery of the backups
Two halves, each deployed separately. Until both are live, nothing runs — the merge alone does nothing.[unverified]
hunter side (hourly, timer)
hunter-vcs-unpushed, from hunter/ansible/roles/housekeeping/ (vcs-unpushed.py, 144 lines). Every hour it rewrites /opt/magenta/vcs-backup/: for every git checkout in every home under /opt/magenta (people's, Moods', agents'), a bundle of any branch that exists on no remote, plus a patch of uncommitted edits to tracked files. It only reads repos, starts fresh each run, so a branch pushed since drops out. Gap, known: untracked files are not backed up — only edits to files git already tracks.[unverified]
maybelle side (hourly at :20, root cron)
/usr/local/bin/pull-hunter-vcs.sh, installed by maybelle/ansible/maybelle.yml at 0582963d: rsync -a --delete root@hunter.cryptograss.live:/opt/magenta/vcs-backup/ /mnt/persist/hunter-vcs/latest/ cp -al latest → daily/$(date -u +%F) # one copy per day find daily -mtime +30 -exec rm -rf # 30 days kept Log: /var/log/pull-hunter-vcs.log. Uses root's existing hunter key — no new secret.[unverified]
What this means for the drill
This job is why the "every branch that mattered was already pushed" line in Cryptograss:Drill:Cold Start Rebuild has teeth: branches that exist only on hunter are saved hourly whether or not anyone pushed them. Untracked files and homes are still declared disposable.[unverified]
How the root authorized_keys got there
Neither box's host-root /root/.ssh/authorized_keys is managed by the repo — the only authorized_keys in it are for user containers and the ssh-router. Justin (1 Nov 2026, 05:14–05:20Z): the keys were put there at provision time through the Hetzner console settings, and he's "pretty sure" of it — not verified. His guess on the unrecognized key (AAAAIBWBhU4r…, in both boxes' root authorized_keys since Dec 2025): probably Skyler's. To be checked for sure later; the Hetzner console setting is the place to look.[unverified]
For the cold-start drill (Cryptograss:Drill:Cold Start Rebuild): a fresh box gets its root keys the same way, so the drill exercises exactly this provisioning path — and if a key is missing from it, that's a finding.[unverified]