diff --git a/README.md b/README.md index 09bd60c..f0931e1 100644 --- a/README.md +++ b/README.md @@ -4,12 +4,12 @@ How to build the web site You need hugo to build the website. On Debian, install it from the 'hugo' package: - # apt install hugo + # apt install hugo Furthermore, you need to checkout the submodules: - website-content $ git submodule init - website-content $ git submodule update + website-content $ git submodule init + website-content $ git submodule update Now you can build the site using 'make', it will be put into 'public'. 'make server' will launch a local server that is useful while editing @@ -22,26 +22,26 @@ On the server, the website is built using gitlab's ci runner, see `.gitlab-ci.yml`. To deploy the site, the ci job rsyncs it to the host. For this purpose, a restricted user is created: - # adduser --system --home /var/www/www-data-rsync --shell /bin/sh --disabled-password --ingroup www-data www-data-rsync + # adduser --system --home /var/www/www-data-rsync --shell /bin/sh --disabled-password --ingroup www-data www-data-rsync Create a key and restrict it to invoke the restricted-rsync script: - # mkdir /var/www/www-data-rsync/.ssh - # chmod 700 /var/www/www-data-rsync/.ssh - # ssh-keygen -t ed25519 -C 'Used for website deployment.' -f www-data-rsync-id_ed25519 - # echo 'command="/usr/local/bin/rrsync /var/www/html --safe-links",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOBBpthbSQ3HgOkhoBwsrZCA9VMX7hRftB5t6LePqtr3 Used for website deployment.' > /var/www/www-data-rsync/.ssh/authorized_keys - # chmod 400 /var/www/www-data-rsync/.ssh/authorized_keys - # chown -R www-data-rsync:www-data /var/www/www-data-rsync/.ssh + # mkdir /var/www/www-data-rsync/.ssh + # chmod 700 /var/www/www-data-rsync/.ssh + # ssh-keygen -t ed25519 -C 'Used for website deployment.' -f www-data-rsync-id_ed25519 + # echo 'command="/usr/local/bin/rrsync /var/www/html --safe-links",no-agent-forwarding,no-port-forwarding,no-pty,no-user-rc,no-X11-forwarding ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOBBpthbSQ3HgOkhoBwsrZCA9VMX7hRftB5t6LePqtr3 Used for website deployment.' > /var/www/www-data-rsync/.ssh/authorized_keys + # chmod 400 /var/www/www-data-rsync/.ssh/authorized_keys + # chown -R www-data-rsync:www-data /var/www/www-data-rsync/.ssh Copy the restricted-rsync script from the docs and make it executable: - # cp /usr/share/doc/rsync/scripts/rrsync /usr/local/bin/ - # chmod +x /usr/local/bin/rrsync + # cp /usr/share/doc/rsync/scripts/rrsync /usr/local/bin/ + # chmod +x /usr/local/bin/rrsync Finally, allow www-data-rsync to write to the document root: - # chown root:www-data /var/www/html - # chmod g+w /var/www/html + # chown root:www-data /var/www/html + # chmod g+w /var/www/html The last bit is to supply the generated secret to gitlab's ci runner via RSYNC_TARGET_SECRET_KEY. Other information that needs to be