← Bosun

Git deploy key (shared, not personal)

One dedicated keypair per app, distributed to every admin/deployer account — never developers, never a personal key.

deploy needs to git clone each app's repo, which normally means SSH access to that repo. Rather than every admin/deployer using their own personal key (which means whitelisting N different keys in your git host, and losing access the moment someone's personal key rotates or they're offboarded), add generates one dedicated keypair per app and distributes it to every current admin/deployer account automatically:

sudo bosun add myapp
  # ── Generated git deploy key for 'myapp' ──
  # Add this PUBLIC key as a Deploy Key on 'myapp's git repo (e.g. GitLab:
  # Project > Settings > Repository > Deploy Keys) — read-only is enough,
  # 'deploy' only ever clones:
  #
  # ssh-ed25519 AAAA... bosun@myapp
  #
  # Distributed 'myapp' deploy key to 2 admin/deployer account(s).

What to do with the printed public key: add it as a Deploy Key on the app's repo (GitLab: Project → Settings → Repository → Deploy Keys; GitHub: Settings → Deploy keys) — read-only access is enough, deploy never pushes. One deploy key per repo, shared by everyone allowed to deploy that app (deployer/admin — see permissions.md); add/remove people from the admin/deployer groups (argus-tty) to control who can, not the git host's key list.

Developer deliberately never gets a copy of this key. require_role() already blocks a plain developer from running deploy at all — handing them a personal, readable copy of the app's git deploy key anyway would be pure unnecessary exposure, especially if that key is also what a GitLab CI pipeline uses (via a dedicated deployer account) to trigger deploys remotely. add actively removes any copy a developer account received under an older version that didn't make this distinction.

Where it lives:

• Private key: /var/www/myapp/shared/deploy_key (600, root:root — nobody can read the private key file directly, even though deployer/admin accounts can use it via deploy).
• Distributed copies: ~/.ssh/bosun/myapp/id_ed25519, one individually-owned 600 copy in every current admin/deployer account's own home directory (never developer's — see above) — deploy (do-release) picks this up automatically via GIT_SSH_COMMAND when it exists, falling back to that account's own default SSH setup (with a warning) if it doesn't.

Re-running add myapp on an existing app leaves an already-generated key untouched and just re-distributes it — safe to re-run any time (e.g. after onboarding a new admin/deployer, to backfill their copy without regenerating the key or re-whitelisting anything in GitLab). Onboard anyone after add already ran once for an app? Re-run sudo bosun add myapp for each such app to distribute that app's key to the new account (this doesn't touch anything already provisioned — .env, deploy.conf, systemd units, etc. are all left exactly as they are).