commit 6f9f1ab04989543abbc8cc0dca6cdd4efcd67d6f
parent a54bf78ca03d3f81dae33e5fcca0b77e6ff033a2
Author: Florian Dold <dold@taler.net>
Date: Sat, 5 Sep 2026 20:12:24 +0200
Devtesting: revoke access when the deployment option is disabled
Always process the devtesting setting. Remove managed keys, sudo access
and helpers, disable the existing account and terminate its sessions
while retaining home-directory data. Restore account access when
enabled.
Diffstat:
6 files changed, 110 insertions(+), 64 deletions(-)
diff --git a/README b/README
@@ -332,6 +332,11 @@ Also run by the CI job in "contrib/ci/jobs/001-build".
## Deployment safety and recovery
+Setting dangerously_enable_devtesting to false revokes the managed login keys,
+sudo access and helper programs, terminates that account's sessions and disables
+the account. Its home-directory data is retained. Setting it true restores the
+managed account settings and access.
+
The KYC attribute encryption key is preserved in a restricted secret include.
Do not rotate this key as a substitute for moving it: changing it without a data
migration would prevent decryption of existing attributes. Auditor authentication
diff --git a/playbooks/setup.yml b/playbooks/setup.yml
@@ -83,7 +83,6 @@
- role: auditor
when: deploy_auditor | bool
- role: devtesting
- when: dangerously_enable_devtesting | bool
post_tasks:
- name: Run post-deployment sanity checks
diff --git a/roles/common_packages/tasks/main.yml b/roles/common_packages/tasks/main.yml
@@ -78,6 +78,7 @@
- jq
- sudo
- uuid-runtime
+ - procps
- wget
- openssl
- libgnunet
diff --git a/roles/devtesting/tasks/disable.yml b/roles/devtesting/tasks/disable.yml
@@ -0,0 +1,32 @@
+---
+- name: Remove devtesting sudo access and managed login keys
+ ansible.builtin.file:
+ path: "{{ item }}"
+ state: absent
+ loop:
+ - /etc/sudoers.d/devtesting
+ - /home/devtesting/.ssh/authorized_keys
+ - /usr/local/bin/taler-devtesting
+ - /usr/local/bin/taler-devtesting-exchange-challenger-setup
+
+- name: Find the existing devtesting account
+ ansible.builtin.getent:
+ database: passwd
+ key: devtesting
+ fail_key: false
+
+- name: Disable the existing account without removing its home
+ ansible.builtin.user:
+ name: devtesting
+ password_lock: true
+ expires: 1
+ shell: /usr/sbin/nologin
+ when: ansible_facts.getent_passwd.devtesting is not none
+
+- name: Terminate existing devtesting sessions
+ ansible.builtin.command:
+ argv: [pkill, -KILL, -u, devtesting]
+ register: devtesting_terminate
+ changed_when: devtesting_terminate.rc == 0
+ failed_when: devtesting_terminate.rc not in [0, 1]
+ when: ansible_facts.getent_passwd.devtesting is not none
diff --git a/roles/devtesting/tasks/enable.yml b/roles/devtesting/tasks/enable.yml
@@ -0,0 +1,64 @@
+- name: Recollect facts
+ setup:
+ no_log: true
+
+- name: Install devtesting dependencies
+ apt:
+ name:
+ - python3-click
+ - taler-harness
+ state: latest
+ when: ansible_facts["os_family"] == 'Debian'
+
+- name: Ensure group for devtesting exists
+ group:
+ name: devtesting
+
+- name: Ensure technical user for devtesting exists
+ user:
+ name: devtesting
+ group: devtesting
+ shell: /bin/bash
+ password: "!"
+ expires: -1
+
+- name: Place devtesting helper
+ ansible.builtin.copy:
+ src: files/taler-devtesting
+ dest: /usr/local/bin/taler-devtesting
+ owner: root
+ group: root
+ mode: "0755"
+
+
+- name: Place challenger devtesting helper
+ ansible.builtin.copy:
+ src: files/taler-devtesting-exchange-challenger-setup
+ dest: /usr/local/bin/taler-devtesting-exchange-challenger-setup
+ owner: root
+ group: root
+ mode: "0755"
+
+- name: Grant sudo rights to devtesting user
+ ansible.builtin.copy:
+ src: etc/sudoers.d/devtesting
+ dest: /etc/sudoers.d/devtesting
+ owner: root
+ group: root
+ mode: "0644"
+
+- name: Ensure .ssh dir exists for devtesting user
+ file:
+ path: "/home/devtesting/.ssh/"
+ state: directory
+ owner: devtesting
+ group: devtesting
+ mode: "0755"
+
+- name: Allow devtesting users access via SSH
+ ansible.builtin.template:
+ src: templates/authorized_keys
+ dest: "/home/devtesting/.ssh/authorized_keys"
+ owner: devtesting
+ group: devtesting
+ mode: "0644"
diff --git a/roles/devtesting/tasks/main.yml b/roles/devtesting/tasks/main.yml
@@ -1,63 +1,8 @@
-- name: Recollect facts
- setup:
- no_log: true
-
-- name: Install devtesting dependencies
- apt:
- name:
- - python3-click
- - taler-harness
- state: latest
- when: ansible_facts["os_family"] == 'Debian'
-
-- name: Ensure group for devtesting exists
- group:
- name: devtesting
-
-- name: Ensure technical user for devtesting exists
- user:
- name: devtesting
- group: devtesting
- shell: /bin/bash
- password: "!"
-
-- name: Place devtesting helper
- ansible.builtin.copy:
- src: files/taler-devtesting
- dest: /usr/local/bin/taler-devtesting
- owner: root
- group: root
- mode: "0755"
-
-
-- name: Place challenger devtesting helper
- ansible.builtin.copy:
- src: files/taler-devtesting-exchange-challenger-setup
- dest: /usr/local/bin/taler-devtesting-exchange-challenger-setup
- owner: root
- group: root
- mode: "0755"
-
-- name: Grant sudo rights to devtesting user
- ansible.builtin.copy:
- src: etc/sudoers.d/devtesting
- dest: /etc/sudoers.d/devtesting
- owner: root
- group: root
- mode: "0644"
-
-- name: Ensure .ssh dir exists for devtesting user
- file:
- path: "/home/devtesting/.ssh/"
- state: directory
- owner: devtesting
- group: devtesting
- mode: "0755"
-
-- name: Allow devtesting users access via SSH
- ansible.builtin.template:
- src: templates/authorized_keys
- dest: "/home/devtesting/.ssh/authorized_keys"
- owner: devtesting
- group: devtesting
- mode: "0644"
+---
+- name: Enable devtesting access
+ ansible.builtin.include_tasks: enable.yml
+ when: dangerously_enable_devtesting | bool
+
+- name: Revoke devtesting access
+ ansible.builtin.include_tasks: disable.yml
+ when: not (dangerously_enable_devtesting | bool)
