nordisk/edda

nornir-git · sshkey — the beginner's guide

What is a "deploy key"?

To pull code from a private git repo without typing a password, a machine needs an SSH key: two files that belong together. The private one (id_ed25519) stays secret on the machine; the public one (id_ed25519.pub) you paste into the repo's settings as a "deploy key". After that, the machine can clone/fetch that repo, and nothing else.

What does sshkey do?

It makes that pair of files, in pure Rust, without running the ssh-keygen command. One call:

let key = nornir_git::sshkey::ensure_deploy_key(
    std::path::Path::new("/home/dwarves"), uid, gid,
)?;
println!("{}", key.pubkey);   // ← paste this line as the repo deploy key

That writes /home/dwarves/.ssh/id_ed25519 (secret, locked so only its owner can read it) and id_ed25519.pub (safe to share), and gives the folder to the dwarves service user.

Three things to remember

1. Run it once. Call it again and it keeps the key you already have — it will not clobber a working machine. It just hands you the same public key back.
2. The secret file is locked (0600). Only its owner can read it. That is on purpose. Don't loosen it.
3. There is only ONE copy of this code. nornir and dwarves both call this same function. If you're writing a new service, call nornir_git::sshkey too — don't paste your own version.

Why not just run ssh-keygen?

Because nordisk tooling must be pure-Rust and shell-free (Law #9), so it works the same on a locked-down / airgapped box where ssh-keygen might not be installed. sshkey does the whole thing in-process.