-
|
I'm not sure if this is the right place for this kind of question or if the issue I filed is in the right place, so x-posting it here: dokku/github-action#96 Has anyone tried to get this kind of setup to work before? Would appreciate any insights as I've already spent a couple hours banging my head against the wall trying to get this to work. Thanks! |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 7 replies
-
|
Answering my own question: the usual Dokku GitHub Actions step is not compatible with Tailscale because it assumes "sshcommand" will run commands upon a new ssh session being started. Unfortunately, sshcommand works with As a workaround, just run Dokku commands manually. You will need to:
|
Beta Was this translation helpful? Give feedback.
-
|
Sorry I haven't had time to read through this recently. Just saw the first part of this comment - removing sshcommand. That won't happen, as it is what forces the dokku command to happen on push. Without this, folks using ssh can run anything whatsoever. It basically breaks the security model, so it won't be removed. You can avoid it by adding an ssh key directly to the authorized_keys file but then I'm not supporting things not working as expected. This actually causes fun issues around pushing for folks. IIRC tailscale circumvents this model by running its own ssh server and providing direct access to users. That's normally fine, but I don't think is good for the way dokku works. |
Beta Was this translation helpful? Give feedback.
-
|
@josegonzalez got it, makes sense. I think the git push stuff is outside of my workflow since I use the from-image command to deploy a docker image. What do you think about adding a flag to the GitHub actions image that enables running commands using dokku as a prefix as I’ve described above? |
Beta Was this translation helpful? Give feedback.
-
|
Wouldn't fix regular pushes. Should we instead see how to get tailscale to respect sshcommand somehow? |
Beta Was this translation helpful? Give feedback.
-
Yeah good point. The way tailscale works though is by bypassing ssh keys entirely, so it’s not going to read authorized_keys today. I’ll raise an issue on the tailscale repo to see what they think. I’m not sure how it would know which specific key to read since it doesn’t use them (and therefore what is the right command to run) but maybe their team has an opinion on how to handle EDIT: There's probably a way to solve this by looking up the command by the fingerprint of the key being passed, while ignoring the key for authentication purposes. I gave them that suggestion in the issue below. |
Beta Was this translation helpful? Give feedback.
-
|
Update: filed an issue here: tailscale/tailscale#14846 |
Beta Was this translation helpful? Give feedback.
Answering my own question: the usual Dokku GitHub Actions step is not compatible with Tailscale because it assumes "sshcommand" will run commands upon a new ssh session being started. Unfortunately, sshcommand works with
authorized_keyswhich Tailscale completely bypasses due to the way it works.As a workaround, just run Dokku commands manually. You will need to: