nordisk/edda

nornir-git · sshkey — guide

How to mint the git SSH deploy key for a nordisk service, in pure Rust with no ssh-keygen subprocess. This is the ONE implementation nornir and dwarves share (LAW #5).

When you want it

At service install time, right after you've ensured the dedicated system user (nornir → nornir, dwarves → dwarves, holger → holger). Each service authenticates its git clone/fetch with its own ed25519 deploy key at /home/<user>/.ssh/id_ed25519; the public half is what you paste into the repo's deploy-key settings.

The service-install call

use nornir_git::sshkey;

// `home` = /home/dwarves, `(uid, gid)` from ensure_<service>_user().
let key = sshkey::ensure_deploy_key(std::path::Path::new("/home/dwarves"), uid, gid)?;

println!("add this as a repo deploy key:\n{}", key.pubkey);
// key.created   → true if freshly minted, false if one already existed
// key.private_path → /home/dwarves/.ssh/id_ed25519 (mode 0600, owned by uid:gid)

ensure_deploy_key is idempotent and root-only in practice (it chowns into another user's home). Run it once per install; re-running preserves the live key and hands back the same pubkey. The OpenSSH comment is taken from the home basename, so /home/dwarves mints dwarves@<hostname>.

The primitive (any directory)

If you just want a keypair somewhere (e.g. a dev identity under ~/.nornir/ssh) without the chown, call the primitive:

let created = sshkey::generate_ed25519_openssh(&dir, "nornir@loki")?;
// writes <dir>/id_ed25519 (0600) + id_ed25519.pub (0644); dir created 0700.
// created == false when <dir>/id_ed25519 already exists.

What lands on disk

The private key is owner-only — never world-readable. nornir_git::ssh reads this exact file to authenticate git-upload-pack over SSH.

Verifying it works

cargo test -p nornir-git covers it (RED when broken): the minted key re-parses as a real ed25519 OpenSSH key, the private half is 0600, the public half has the deterministic ssh-ed25519 … <user>@<host> shape, and a second call is a no-op. Under --features testmatrix the mint also records functional_status matrix rows (ensure_deploy_key_mints, deploy_key_is_valid_ed25519, deploy_key_idempotent); release builds strip those to no-ops.

Do NOT

• Do NOT shell out to ssh-keygen (LAW #9) — this crate is the pure-Rust path.
• Do NOT re-twin this in a service repo (LAW #5) — call nornir_git::sshkey.
• Do NOT loosen the 0600 on the private key — a deploy key that leaks is a repo compromise.