Use Generated SSH Key Stored in `password-store` #26

New issue

Open

opened 2023-08-21 14:51:13 +02:00 by so-rose · 0 comments

so-rose commented

2023-08-21 14:51:13 +02:00

Owner

We can use a pre-generated ssh keypair, stored in password-store, instead. This can then be access-controlled using the usual password-store mechanisms.

Ideally #24 would be implemented first, so generating (and expiring!) this secret can be done in a reproducible way.

We currently use the system SSH client + key. This isn't ideal - it greatly complicates use from within containers (ex. for CI or Windows users), and ties the security of the system directly to the individual developer. We can use a pre-generated ssh keypair, stored in `password-store`, instead. This can then be access-controlled using the usual `password-store` mechanisms. Ideally #24 would be implemented first, so generating (and expiring!) this secret can be done in a reproducible way.