Sam Rolfe
7d367f7712
The 06:00 workflow is now one schedule-trigger -> Execute Command pair that runs scripts/morning-brief.sh on the host over a restricted SSH key. The earlier scan -> HTTP shape could not work: the n8n container cannot resolve the `remote` ssh alias (its ~/.ssh/config is a dangling nix symlink) and a split scan node hides scan failures before the notify node runs. - deploy/n8n-morning-brief.json: two-node workflow, scheduleTrigger v1.3 - deploy/setup-n8n-scan-key.sh: restricted (restrict,command=) trigger key - deploy/import-n8n-morning-brief.sh: import + publish + restart + verify - deploy/DEPLOYMENT.md, Makefile: document and expose both scripts (dry run) - docs/phase-7a-n8n-schedule.md: design, verification, failure drill Import into the shared n8n service still needs Sam's approval. Co-Authored-By: Paperclip <noreply@paperclip.ing>
70 lines
2.1 KiB
Bash
Executable File
70 lines
2.1 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Phase 7a (AUD-115): the SSH trigger key for the 6:00am n8n workflow.
|
|
#
|
|
# The n8n container mounts ~/.ssh read-only at /home/node/.ssh (see the n8n
|
|
# compose file). This script creates a dedicated key there and prints the exact
|
|
# `authorized_keys` line that restricts it to one command. Nothing else can use
|
|
# the key: no shell, no port forwarding, no agent.
|
|
#
|
|
# This writes under $HOME/.ssh, which is OUTSIDE this repository. Run it only
|
|
# after the change is approved. Default run is a dry run and prints the plan.
|
|
#
|
|
# Usage:
|
|
# deploy/setup-n8n-scan-key.sh # dry run, print the plan
|
|
# deploy/setup-n8n-scan-key.sh --apply # create the key + authorize it
|
|
#
|
|
# Environment overrides:
|
|
# KEY private key path (default ~/.ssh/id_ed25519_school_scan)
|
|
# SCAN_CMD forced command (default the morning brief on the host)
|
|
set -euo pipefail
|
|
|
|
KEY="${KEY:-$HOME/.ssh/id_ed25519_school_scan}"
|
|
SCAN_CMD="${SCAN_CMD:-cd /home/sam/paseo/projects/compass_teams_nhs && ./scripts/morning-brief.sh}"
|
|
AUTH="${AUTH:-$HOME/.ssh/authorized_keys}"
|
|
COMMENT="n8n-school-scan"
|
|
|
|
APPLY=0
|
|
case "${1:-}" in
|
|
--apply) APPLY=1 ;;
|
|
-h|--help) sed -n '2,20p' "$0"; exit 0 ;;
|
|
'') ;;
|
|
*) echo "unknown argument: $1" >&2; exit 2 ;;
|
|
esac
|
|
|
|
if [[ "$APPLY" -eq 0 ]]; then
|
|
echo "DRY RUN — no files are written. Re-run with --apply."
|
|
fi
|
|
|
|
if [[ ! -f "$KEY" ]]; then
|
|
if [[ "$APPLY" -eq 1 ]]; then
|
|
echo "creating $KEY"
|
|
ssh-keygen -t ed25519 -N '' -C "$COMMENT" -f "$KEY" >/dev/null
|
|
else
|
|
echo "would create key : $KEY ($COMMENT)"
|
|
fi
|
|
fi
|
|
|
|
PUB="$(cat "$KEY.pub" 2>/dev/null || echo '<key not created yet>')"
|
|
LINE="restrict,command=\"$SCAN_CMD\" $PUB"
|
|
|
|
echo "key : $KEY"
|
|
echo "forced command : $SCAN_CMD"
|
|
echo "authorized_keys : $AUTH"
|
|
echo
|
|
echo "line to add:"
|
|
echo " $LINE"
|
|
|
|
if [[ "$APPLY" -eq 1 ]]; then
|
|
if grep -qF "$PUB" "$AUTH"; then
|
|
echo
|
|
echo "public key already present in $AUTH — nothing to add"
|
|
else
|
|
printf '%s\n' "$LINE" >> "$AUTH"
|
|
chmod 600 "$AUTH"
|
|
echo
|
|
echo "added the restricted key to $AUTH"
|
|
fi
|
|
echo
|
|
echo "the n8n container now sees it at: /home/node/.ssh/$(basename "$KEY")"
|
|
fi
|