# Adding an SSH deployment key to a git repo

John Simpson `<jms1@jms1.net>` 2019-04-19, last updated 2019-07-28

I originally wrote this document to explain how to attach a "deployment key" to a set of git repos, in order to allow Puppet's "Code Manager" process to clone those repos when building environment directories. I then realied that the same information could be useful for others, so I've stripped out any specific work-related information and am putting this document under `/keybase/public/jms1/notes/git/` so that others can use it.

The information below talks about other `git` servers because when I originally wrote this up, I wrote it up for myself at home, I wasn't sure which server type I was going to use for my own personal Puppet git repos, so I tried it with several different git server options.

## [Bitbucket](https://bitbucket.org/)

This is what we are currently using at work for all of our `git` repos.

* In the Bitbucket web interface, go to the repo's settings.
* On the left, under "GENERAL", click "Access keys".
* Click the "Add key" button.
* Enter a title, such as "`np-dev.eng.dmain.xyz code manager 2018-08-13`".
* Copy and paste the full contents of the "`id_rsa_code_manager.pub`" file into the "Key" box.
* Click the "Add key" button.

## [GitHub](https://github.com/)

* In the GitHub web interface, go to the repo's settings.
* Click "Deploy keys" in the list on the left.
* Click the "Add deploy key" button at the top right.
* Enter a title, such as "`np-dev.eng.dmain.xyz code manager 2018-08-13`".
* Copy and paste the full contents of the `id_rsa_code_manager.pub` file into the "Key" box.
* Make sure the "Allow write access" box is **NOT** checked.
* Click the "Add key" button.
* You may be prompted to enter your password or tap your security key.
    * Requiring this prevents an attacker who may have highjacked your session token from being able to modify the security settings of your repos.
    * Another reason to use U2F security tokens wherever possible.

## [GitLab](https://gitlab.com/)

This is the process I used with repos hosted on `gitlab.com`. I *think* the process is the same if you're hosting the open-source Gitlab software on your own machine.

* In the GitLab web interface, go to "Settings -> Repository".
* Expand the "Deploy Keys" section.
* Enter a title, such as "`np-dev.eng.dmain.xyz code manager 2018-08-13`".
* Copy and paste the full contents of the `id_rsa_code_manager.pub` file into the "Key" box.
* Make sure the "Write access allowed" box is **NOT** checked.
* Click the "Add key" button.

## [Gitea](https://gitea.io/)

I hadn't heard of this one before, but it's free and open source, and it's what Puppet uses within their training environments when you take their classes. It seems to be similar to a self-hosted GitLab instance.

* In the Gitea web interface, go to the repo's settings.
* Click the "Deploy Keys" tab.
* Click the "Add Deploy Key" button.
* Enter a title, such as "`np-dev.eng.dmain.xyz code manager 2018-08-13`".
* Copy and paste the full contents of the `id_rsa_code_manager.pub` file into the "Key" box.
* Make sure the "Enable Write Access" box is **NOT** checked.
* Click the "Add Deploy Key" button.

## [Gitolite](https://gitolite.com/)

I've been using Gitolite on my personal git server for several years. Instead of having a web interface, its configuration is done using the contents of a special "`gitolite-admin`" git repo.

Gitolite doesn't have a way to assign a read-only SSH key to a particular repository. Instead, we will create a gitolite user with the SSH key, and then give that user read-only permissions to the appropriate repositories.

Because Gitolite's configuration file allows you to create an alias for a set of repositories, you can create an alias which covers all of your Puppet-related repos, and then give this user read-only permissions to the alias. The example below will hopefuly make this clear.

The files mentioned below will exist in the server's `gitolite-admin` repo.

* Select a username. In this example, I'm using `codeman`.

    The username itself isn't important - it will never be used outside of the `gitolite.conf` file itself.

* Create a gitolite user with this name, using the SSH public key you created above.

    Copy the `id_rsa_code_manager.pub` file to `keydir/`**`codeman`**`.pub`.

* Give the new user read-only access to the Puppet repos.

    Update `conf/gitolite.conf`. Give the new user read-only permission to the appropriate repos.

    ```
    # Create an alias for all Puppet-related repos
    @newpup = jp-control
    @newpup = jp-hieradata
    @newpup = jp-ntpd
    # ...

    # Set permissions for all of these repos at once
    repo @newpup
        RW+ = @admins
        R   = codeman
    ```

* Commit and push the changes.