Brad Anderson
9be475f072
Confirmed cause of the reported 401: a runner registration token in /etc/dejima-ci/forge-token. The two tokens come from different pages, are not interchangeable, and this tool asks for both within minutes of each other while calling one of them "a forge token". The previous commit added that distinction to the allowlist's 401 message and to the install prompt. This adds it to the third place, which is the one the operator actually reaches first now that the token is probed early: the probe's own 401. It leads with the registration token rather than mentioning it last, because between "you mistyped it" and "that is a different kind of string", only one of those is worth checking before re-reading a token you already believe is correct. The preflight hint and etc/config.example said "a READ-ONLY forge token" and "read access and nothing else", which describe the permissions of a token whose kind was never in question. Both now name the page it comes from and say which one it is not. The test that asserted on the old hint wording now asserts on the property instead: that the message names an API token and distinguishes it from a registration token. 61 ok, 0 failed.
73 lines
3.1 KiB
Plaintext
73 lines
3.1 KiB
Plaintext
# dejima-ci-hardener configuration. Install at /etc/dejima-ci/config.
|
|
#
|
|
# Read by dejima-ci-allowlist and dejima-ci-firewall both, so the job network
|
|
# is described once rather than edited into each of them separately.
|
|
#
|
|
# Parsed, never sourced: key = value, # starts a comment, unknown keys are a
|
|
# hard error rather than a silent typo.
|
|
|
|
# --- the job network --------------------------------------------------------
|
|
# Created by install.sh. The bridge name is fixed rather than left for Docker
|
|
# to generate, because it is what the firewall rules match on.
|
|
network = dejima-ci
|
|
bridge = dejima-ci0
|
|
|
|
# The bridge's gateway address. The resolver listens here, and job containers
|
|
# are pointed at it by the runner's --dns. Use a PRIVATE range: dnsmasq's
|
|
# stop-dns-rebind is keyed on the private ranges, so a reserved-but-not-private
|
|
# subnet is one that check silently does not cover.
|
|
gateway = 10.89.0.1
|
|
|
|
# The set the resolver populates and the firewall matches on.
|
|
ipset = ci-allow
|
|
|
|
# The forge's API root. Read-only access is all this needs.
|
|
forge_api = https://gitea.example.com/api/v1
|
|
|
|
# A token file, mode 0600, owned by root. A forge API token, from the forge's
|
|
# Settings -> Applications page, with read access to repository contents and
|
|
# nothing else - this program only ever GETs one file per repository.
|
|
#
|
|
# NOT a runner registration token. That is the string from Actions -> Runners
|
|
# that registers a runner, which dejima-ci-runners asks for separately. The API
|
|
# rejects it with a 401, and nothing about the file says which kind it holds.
|
|
token_file = /etc/dejima-ci/forge-token
|
|
|
|
# One owner/repo per line. These are the repositories whose declarations are
|
|
# allowed to widen this runner's allowlist, so the list is itself a grant:
|
|
# adding a line here trusts that repository's main branch.
|
|
repos_file = /etc/dejima-ci/repos
|
|
|
|
# Names allowed regardless of any project declaration. Keep it short, and
|
|
# keep it narrower than dejima's own built-in domains - a name judged
|
|
# reasonable for a firewalled container is a different proposition on a host
|
|
# on your network.
|
|
base_file = /etc/dejima-ci/base-domains
|
|
|
|
# The resolver dnsmasq forwards ALLOWED queries to - the one that actually
|
|
# knows the answers.
|
|
#
|
|
# It is NOT the dnsmasq this configures (that would loop), and NOT the job
|
|
# bridge gateway. It is whatever this host already resolves with:
|
|
#
|
|
# grep nameserver /etc/resolv.conf
|
|
#
|
|
# If that gives 127.0.0.53 this host runs systemd-resolved and the answer is
|
|
# behind the stub: resolvectl status | grep 'DNS Servers'. Elsewhere
|
|
# resolvectl does not exist, and /etc/resolv.conf is the whole answer.
|
|
#
|
|
# It has to be able to resolve everything on the allowlist, INCLUDING your
|
|
# forge - so if that name is internal, this has to be your internal DNS.
|
|
# `no-resolv` in the dnsmasq config means it will not read /etc/resolv.conf
|
|
# itself, which is why this has to be named explicitly.
|
|
upstream = 198.51.100.53
|
|
|
|
# Rendered output, picked up by dnsmasq's conf-dir.
|
|
out = /etc/dnsmasq.d/ci-allow.conf
|
|
|
|
# The branch treated as operator-approved. Changing this to anything a
|
|
# pull request can write gives up the entire point of this program.
|
|
ref = main
|
|
|
|
reload = systemctl reload dnsmasq
|